Implement announce/watch: a deploy signal that reverses CI's reach

CI announces a new image tag to keep (any grant is enough, read-only
included); each deploy target polls for it locally instead of CI
holding standing SSH access to production. keep stays a pure relay —
the tag lives outside the encrypted vault payload in its own table,
and keep never executes anything itself.

Adds vault_announcements, POST/GET /vaults/:key/announce, and the
`keep announce`/`keep watch` CLI commands, per
PROPOSAL-announce-and-agent.md (now marked implemented). Verified live:
a read-only identity announcing successfully and being logged, watch
picking up the tag on its first poll, and watch exiting nonzero for an
unknown/ungranted vault.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

PROPOSAL-announce-and-agent.md

@@ -1,8 +1,15 @@
 # Proposal: announce + a self-deploying agent, with a no-`keep` fallback
 
-**Status:** proposed, not built. Self-contained — written so a fresh agent
-with no prior conversation context can pick this up and implement it
-without anything explained first.
+**Status:** implemented (§1–§3, §6 shape). `announce`/`watch`, the
+`vault_announcements` table, and the API routes described below are
+built — see [IMPLEMENTATION.md](./IMPLEMENTATION.md)'s "Announce/watch"
+section for the as-built version of the design rationale, and the CLI
+surface list there for the exact commands. §4 (patching the real bulk
+deploy script) and §6 (the CI workflow step) are per-project changes
+made outside this repo, on the host and in each project's own
+`.gitea/workflows/docker.yml` — not something this repo's code can
+contain. This file is kept as the original design record, superseded by
+IMPLEMENTATION.md as the source of truth for what's actually built.
 
 ## Context (read this first)