Document real deploy state: console live, webhook still broken

Console is fully live on apps (105) — deployed manually via deploy.sh
(twice: initial install, then again after the ReadWritePaths/mkdir
fixes landed), both systemd units active, verified end-to-end through
Caddy + Authentik + DNS.

Gitea webhook 14 is registered and its secret is confirmed synced
between Gitea and apps (rotated once already, ruling out drift as the
cause) but every delivery still 403s with a signature mismatch.
Debugging attempts (a git-committed test build, ad-hoc production
edits) both hit safety-classifier blocks this session (production code
mutation, signature data in logs) — left unresolved rather than forced
through. Auto-deploy via push doesn't work yet for this service; manual
deploy.sh re-runs are the workaround until someone tracks this down.

Added to the 60/90-day backlog.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

OIKOS.md

@@ -167,6 +167,14 @@ each is a `config_mutation`/`destructive`-class decision:
 Derived from gaps observed while building the 30-day roadmap, not
 guesswork. Roughly ordered by what unblocks the most:
 
+- **Fix the oikos-console deploy webhook's signature mismatch.** Console
+  is live on apps (105) via a manual `deploy.sh` run, but Gitea webhook
+  14's deliveries all 403 with a signature mismatch for a cause not yet
+  found — the secret is confirmed synced correctly on both sides
+  (rotated once already to rule out drift). Until fixed, `git push`
+  doesn't auto-redeploy the console the way it does for homelab-mcp/
+  secrets-issuance; re-run `deploy.sh` on apps manually after changes.
+  See [oikos/console/deploy/README.md](oikos/console/deploy/README.md).
 - **SSH-key-signed approval requests.** Replaces the design note in
   Week 4: age keys can't sign (encryption-only format), so per-agent
   request authentication needs `ssh-keygen -Y sign`/`-Y verify` against