feat(deploy): add webhook receiver and launchd service for push-to-deploy

- cmd/webhook/main.go: HMAC-validated webhook receiver on :9797
- launchd plist: keeps webhook running, PATH includes docker
- Makefile: 'make webhook' target
- Registered as Gitea webhook id 15 on dtoro/oikos

Fixes: auto-deploy was not wired on mac-mini after the consolidation

scripts/deploy/network.hubris.oikos-deploy-webhook.plist

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>network.hubris.oikos-deploy-webhook</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/Users/dtoro/Projects/oikos/webhook</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>WEBHOOK_HMAC_SECRET</key>
+        <string>6502524162d6dbc3f6d137000395d401f1837d74ef9bb0a876f8e6bbd65d1ff2</string>
+        <key>WEBHOOK_REPO_DIR</key>
+        <string>/Users/dtoro/Projects/oikos</string>
+        <key>WEBHOOK_LISTEN</key>
+        <string>:9797</string>
+        <key>HOME</key>
+        <string>/Users/dtoro</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    </dict>
+    <key>WorkingDirectory</key>
+    <string>/Users/dtoro/Projects/oikos</string>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/Users/dtoro/Library/Logs/oikos-webhook.log</string>
+    <key>StandardErrorPath</key>
+    <string>/Users/dtoro/Library/Logs/oikos-webhook.log</string>
+</dict>
+</plist>