feat: auto-deploy tagged releases to CT 126 via signed webhook (0.3.1)

CI's new deploy job (tags only) sends the house HMAC webhook to CT 126; the
listener runs /usr/lib/devdesk/devdesk-deploy, which waits for the version in
the apt registry and upgrades devdesk with --force-confold. Running sessions
are untouched. Hook setup is documented in docs/DEPLOY.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -39,7 +39,8 @@ install: all
 	install -m 0755 bin/devdesk $(DESTDIR)$(PREFIX)/bin/devdesk
 	install -m 0644 libexec/devdesk-lib.sh $(DESTDIR)$(LIBDIR)/devdesk-lib.sh
 	install -m 0755 libexec/devdesk-picker libexec/devdesk-claude-run libexec/devdesk-session-hook \
-		libexec/devdesk-tmux-ready libexec/devdesk-serve libexec/devdesk-statusline $(DESTDIR)$(LIBDIR)/
+		libexec/devdesk-tmux-ready libexec/devdesk-serve libexec/devdesk-statusline \
+		libexec/devdesk-deploy $(DESTDIR)$(LIBDIR)/
 	install -m 0755 build/ttyd $(DESTDIR)$(LIBDIR)/bin/ttyd
 	install -m 0644 dist/index.html share/tmux.conf share/claude-settings.json $(DESTDIR)$(SHAREDIR)/
 	install -m 0644 etc/env $(DESTDIR)$(SYSCONFDIR)/devdesk/env