feat: auto-deploy tagged releases to CT 126 via signed webhook (0.3.1)

CI's new deploy job (tags only) sends the house HMAC webhook to CT 126; the
listener runs /usr/lib/devdesk/devdesk-deploy, which waits for the version in
the apt registry and upgrades devdesk with --force-confold. Running sessions
are untouched. Hook setup is documented in docs/DEPLOY.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -71,8 +71,8 @@ apt install ../devdesk_*_amd64.deb
 
 CI (`.gitea/workflows/build-deb.yml`):
 - Every push lints, tests, builds and smoke-tests the package and uploads it as an artifact.
-- A `v*` tag also publishes to `https://code.lotusguild.org/api/packages/LotusGuild/debian` and creates a release.
+- A `v*` tag also publishes to `https://code.lotusguild.org/api/packages/LotusGuild/debian`, creates a release, and auto-deploys to CT 126. A signed webhook runs `devdesk-deploy`, which upgrades the package; see [docs/DEPLOY.md](docs/DEPLOY.md).
 
 ## Roadmap
-- **v1.1:** `devdesk-api` sidecar for the Repo/CI panel, Matrix notifications when you're away, and auto-deploy.
+- **Next:** Matrix notifications when you're away (needs the Ci-Alert hookshot URL).
 - **v2:** Ops Alerts (Grafana) with "Ask Claude" prompts, and file drop.