fix(soong-lab-ci): sync web/ frontend on deploy (was serving stale web)

soong-dev found the studio serving a stale web/ (52015 vs 55025 bytes — missing the
01-Role section, favicon, thinking-status): the deploy rsynced backend/ but never web/,
so SOONG_LAB_WEB_DIR stayed pinned to the initial manual copy while the backend updated.
Deploy now rsyncs BOTH backend/->studio AND web/->SOONG_LAB_WEB_DIR (read from the env)
on every green run. Verified: served frontend now 55025 bytes, current.

docs/runbooks/soong-lab-autodeploy.md

@@ -12,7 +12,7 @@ push→main → gitea webhook (POST, HMAC) → soong-webhook listener :9010 on c
   → ~/soong-lab-deploy.sh:
        git clone (read-only deploy key, internal SSH :222)
        uv sync ; uv run pytest        ── RED → abort, studio UNTOUCHED, status=red
-       rsync backend/ → studio dir ; uv sync --no-dev ; systemctl restart
+       rsync backend/ → studio dir + web/ → SOONG_LAB_WEB_DIR ; uv sync --no-dev ; restart
        → status=green, studio healthy
 ```
 
@@ -43,6 +43,12 @@ ssh corviduo-dev 'bash ~/soong-lab-deploy.sh'
 
 ## Notes / gotchas
 
+- **Frontend (`web/`) sync IS part of the deploy**: the studio serves `web/` from
+  `SOONG_LAB_WEB_DIR` (`/home/infra-ops/soong-lab/web`), *separate* from the backend
+  `WorkingDirectory`. The deploy rsyncs BOTH `backend/`→studio and `web/`→`SOONG_LAB_WEB_DIR`.
+  (Added 2026-07-13 after soong-dev caught the served frontend silently rotting — the backend
+  was updating while `web/` stayed pinned to the initial manual copy; a bounce alone re-serves
+  the same stale file.)
 - **Green-gated by construction**: `pytest || fail` runs BEFORE any studio touch,
   so a red suite aborts with the studio still on the old version. Validated
   2026-07-13 (a mid-deploy rsync failure left the studio untouched/active).