feat(soong-lab-ci): green-gated push-to-deploy CI/CD for the soong-lab studio

Vuong-directed. gitea webhook (push→main) → HMAC listener on corviduo-dev:9010 →
clone (read-only deploy key) → uv sync + pytest → redeploy soong-lab-studio.service
ONLY on green (running studio untouched on red). Validated end-to-end 2026-07-13.
Canonical copies of the deploy script + listener + unit; runbook in docs/runbooks.

services/soong-lab-ci/soong-webhook.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=soong-lab CI webhook listener (push->main -> test-gated redeploy)
+After=network-online.target
+
+[Service]
+Type=simple
+User=infra-ops
+ExecStart=/usr/bin/python3 /home/infra-ops/soong-webhook.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target