Publish the CRX from a timer, and refuse an unbumped version

Mirrors the autotrader stack's auto-deploy: fetch every minute, act when master
moves, lock against overlap, rewrite .last-check every run so a silent failure
is visible. Only extension/ and deploy/ changes publish - repacking for a docs
edit would republish an identical CRX every minute.

The guard is the part that earns its place. Chrome ignores a CRX that is not
strictly newer, so shipping extension changes without bumping manifest.json is
a no-op that looks exactly like success until someone notices the fix never
arrived. That now fails loudly instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/autofirmer-publish.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Publish a new AutoFirmer CRX when Gitea's master branch moves
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/autofirmer
+ExecStart=/opt/autofirmer/deploy/auto-publish.sh
+# Packing pulls a node image on a cold cache; well inside this.
+TimeoutStartSec=1800