worklyn / zukapublic

Adds the CI spec, the deploy script and the systemd trigger that let the
service ship itself, plus the pieces that made it possible:

- build.rs embeds the commit, so upgrade detection compares version+commit
  rather than a version nobody remembers to bump
- setup --instance, so the build instance can live beside the control plane;
  a build running inside the service it restarts would kill its own deploy
- the live suite can be pointed at a specific binary, so it exercises the
  musl build that actually ships

CI holds no privilege. It stages a binary and writes a request; a root path
unit runs the deploy, checks the new build is the one answering, and rolls
back if it is not.