phase 6: deploy pipeline — CI, cutover checklist, watchdog, verification, rollback

- scripts/deploy.sh: Gitea webhook-triggered deploy (git pull → docker build
  → compose up → health check). SHA-tagged images, rolling restart.
- scripts/watchdog.sh: cron health check every 2min, pages operator via
  Matrix after 3 consecutive failures. Reset on recovery.
- scripts/verify-phase6.sh: 14 end-to-end verification checks against
  plan V1–V14 (ontology, DB, API, scheduler, actuator, learning, classifier,
  hermes, secrets, deploy, knowledge, observability, correlation, cutover).
- scripts/rollback.sh: re-deploy previous SHA tag + pg_restore from
  pre-deploy dump. Health check loop, returns to main branch after.
- scripts/cutover-checklist.md: pre/post-cutover steps — backup, CI gate,
  Caddy re-point, DNS, apps/105 disable, cleanup.
- compose/caddy/Caddyfile.oikos: reverse-proxy config for
  oikos/mcp/hermes.hubris.network → mac-mini mesh IP.
- .gitignore: added bin/ to exclude compiled binaries.

14/14 verification checks pass against running Docker stack.

compose/caddy/Caddyfile.oikos

@@ -0,0 +1,23 @@
+# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover
+# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
+# Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.
+
+# Oikos REST API (operator)
+oikos.hubris.network {
+    reverse_proxy <mac-mini-mesh-ip>:8090
+}
+
+# Oikos MCP endpoint (Hermes agents)
+mcp.hubris.network {
+    reverse_proxy <mac-mini-mesh-ip>:8090
+}
+
+# Oikos API (legacy apps/105 path — redirect or proxy during cutover)
+apis.hubris.network {
+    reverse_proxy <mac-mini-mesh-ip>:8090
+}
+
+# Hermes gateway (workstation access)
+hermes.hubris.network {
+    reverse_proxy <mac-mini-mesh-ip>:8092
+}