feat(arbo): track webhook deploy scripts (arbo-deploy.sh + arbo-webhook.py)

Operator's call: keep the arbo stack in eshpfi and version its deploy machinery
alongside the compose (was host-only on irv-ml1 = recoverability foot-gun).
- arbo-webhook.py: :9009 HMAC listener (secret externalized to host file, not git)
- arbo-deploy.sh: internal-route fetch + catalog-only targeted restart
Document both in the README Q5 section + the internal-gitea-route gotcha.

stacks/arbo/arbo-webhook.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Gitea push-webhook listener: on a verified push to main, trigger ~/arbo-deploy.sh.
+HMAC-SHA256 validated against ~/.config/arbo/webhook-secret (X-Gitea-Signature)."""
+import hashlib, hmac, json, os, subprocess, threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+SECRET = open(os.path.expanduser("~/.config/arbo/webhook-secret"), "rb").read().strip()
+DEPLOY = os.path.expanduser("~/arbo-deploy.sh")
+class H(BaseHTTPRequestHandler):
+    def do_POST(self):
+        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
+        mac = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
+        if not hmac.compare_digest(mac, self.headers.get("X-Gitea-Signature", "")):
+            self.send_response(401); self.end_headers(); self.wfile.write(b"bad signature\n"); return
+        try: ref = json.loads(body).get("ref", "")
+        except Exception: self.send_response(400); self.end_headers(); return
+        if ref != "refs/heads/main":
+            self.send_response(200); self.end_headers(); self.wfile.write(b"ignored " + ref.encode() + b"\n"); return
+        self.send_response(202); self.end_headers(); self.wfile.write(b"deploying\n")
+        threading.Thread(target=lambda: subprocess.run(["bash", DEPLOY]), daemon=True).start()
+    def do_GET(self):
+        self.send_response(200); self.end_headers(); self.wfile.write(b"arbo-webhook ok\n")
+    def log_message(self, *a): pass
+HTTPServer(("0.0.0.0", 9009), H).serve_forever()