feat(soong-lab-ci): red-run althing relay (nh3-dev poll -> ping soong-dev)

Per operator call (no gitea write token on the Worldtree-team VM): a 2-min systemd
--user timer on nh3-dev polls corviduo's last-deploy.json and pings soong-dev via
althing on a NEW red deploy (green stays silent). Delivers soong-dev's red-run
visibility without a credential on corviduo. Tested (red detect+format DRY, green quiet).

docs/runbooks/soong-lab-autodeploy.md

@@ -52,7 +52,11 @@ ssh corviduo-dev 'bash ~/soong-lab-deploy.sh'
   present on corviduo-dev); no extra auth in the deploy script.
 - **SSRF**: gitea reached corviduo-dev `10.250.50.152` fine (test-delivery 204) —
   no `ALLOWED_HOST_LIST` relax needed (unlike the ytvc/WG case).
-- **No althing on corviduo-dev** → red-run notify is log/status-file based
-  (`last-deploy.json` + `GET :9010`). A gitea commit-status or althing relay
-  could be added if push-notify on red is wanted.
+- **Red-run push-notify** via an **althing relay on nh3-dev** (`soong-ci-relay.timer`,
+  2-min poll of corviduo's `last-deploy.json` → pings **soong-dev** via althing on a
+  NEW red run; green runs stay silent = fire-and-forget). corviduo itself has no
+  althing, so the relay lives on nh3-dev (which does), needing no gitea write token
+  on the Worldtree-team VM. Files: `services/soong-lab-ci/soong-ci-relay.{sh,service,timer}`;
+  state `~/.local/state/soong-ci-relay/last-at.txt`. (A gitea commit-status was the
+  alternative but needs a write token gitea won't mint without basic-auth.)
 - Test suite: `uv run pytest` in `backend/` (242 tests as of v0.3.6).