feat(config): triage agent, rotation and vibegram jobs, deploy and komodo hooks, vault watch rules

README.md

@@ -104,6 +104,31 @@ docker compose up -d
 
 Set `PUBLIC_BASE_URL=https://<DOMAIN>` in beaver-agent's `.env` so advertised endpoints use the outside origin.
 
+## Deploy: `main` is work, `stable` is production
+
+Komodo deploys only the `stable` ref; pushing `main` deploys nothing. Commit
+during the day, then ship when the master thread is idle:
+
+```bash
+make deploy                  # git push origin main:stable
+```
+
+The gateway image is built from `beaver-gateway#${GATEWAY_REF}` at deploy
+time, so push the gateway first. `docker-compose.yml` has a healthcheck on
+`/healthz`; Komodo waits for it before it considers the deploy done.
+
+To drain first (архитектура §8.6), call the deploy hook instead of pushing
+by hand: it waits until no master turn is running, then asks Komodo:
+
+```bash
+curl -X POST https://<DOMAIN>/hooks/deploy -H "Authorization: Bearer <TOKEN>"
+```
+
+Needs `KOMODO_URL` / `KOMODO_KEY` / `KOMODO_SECRET` in `.env` (and
+`KOMODO_STACK`, default `beaver-agent`). Komodo alerts can be pointed at
+`POST /hooks/komodo` the same way - they land in the master as an urgent
+inject. Jobs, the queue and the subscription window are on the admin **Jobs** page.
+
 ## Editing config.py on the mac
 
 `make sync` installs `../beaver-gateway` editable (extra `local`), so