conjurer: deploy bot on its own [deploy]-gated image channel

The production bot now tracks conjurer-bot-deploy instead of conjurer-bot,
so it updates only when the conjurer CI promotes a build (commit message
contains [deploy]). Adds the image-updater 'deploy-bot' alias and the
kustomization images entry for it; DEPLOY-BOT.md documents the channel and
the one-time bootstrap. Test bot + librarian keep tracking every build.

Pairs with conjurer#20 (the CI promotion step).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

conjurer/kustomization.yaml

@@ -11,3 +11,6 @@ images:
     newTag: ac16b77f
   - name: gitea.czernobog.pl/gitea/conjurer-bot
     newTag: ac16b77f
+  # Production bot channel - only bumped when a [deploy]-tagged build appears.
+  - name: gitea.czernobog.pl/gitea/conjurer-bot-deploy
+    newTag: ac16b77f