conjurer: deploy bot on its own [deploy]-gated image channel

The production bot now tracks conjurer-bot-deploy instead of conjurer-bot,
so it updates only when the conjurer CI promotes a build (commit message
contains [deploy]). Adds the image-updater 'deploy-bot' alias and the
kustomization images entry for it; DEPLOY-BOT.md documents the channel and
the one-time bootstrap. Test bot + librarian keep tracking every build.

Pairs with conjurer#20 (the CI promotion step).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

conjurer/deploy-bot.yaml

@@ -30,7 +30,11 @@ spec:
       imagePullSecrets: [{ name: gitea-registry }]
       containers:
         - name: bot
-          image: gitea.czernobog.pl/gitea/conjurer-bot:c8aae106
+          # SEPARATE image from the test bot: conjurer-bot-deploy only gets a new
+          # tag when a commit message contains [deploy] (see the conjurer CI), so
+          # this bot updates only on versions you explicitly promote. Tag is
+          # managed by the image-updater (kustomization images:).
+          image: gitea.czernobog.pl/gitea/conjurer-bot-deploy:c8aae106
           ports: [{ containerPort: 5000 }]
           env:
             - { name: CONJURER_DATA_DIR,      value: "/data" }