Publish the CRX from a timer, and refuse an unbumped version

Mirrors the autotrader stack's auto-deploy: fetch every minute, act when master
moves, lock against overlap, rewrite .last-check every run so a silent failure
is visible. Only extension/ and deploy/ changes publish - repacking for a docs
edit would republish an identical CRX every minute.

The guard is the part that earns its place. Chrome ignores a CRX that is not
strictly newer, so shipping extension changes without bumping manifest.json is
a no-op that looks exactly like success until someone notices the fix never
arrived. That now fails loudly instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/install-autopublish.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Install the systemd timer that publishes a new CRX when master moves.
+# Run as root on the droplet:  ./deploy/install-autopublish.sh
+set -euo pipefail
+cd "$(dirname "$0")/.."
+[ "$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }
+
+install -m 644 deploy/autofirmer-publish.service /etc/systemd/system/
+install -m 644 deploy/autofirmer-publish.timer   /etc/systemd/system/
+systemctl daemon-reload
+systemctl enable --now autofirmer-publish.timer
+
+echo
+echo "  installed. next run:"
+systemctl list-timers autofirmer-publish.timer --no-pager | sed -n '2p'
+echo
+echo "  logs:       tail -f /opt/autofirmer/deploy/publish.log"
+echo "  heartbeat:  cat /opt/autofirmer/deploy/.last-check"
+echo "  disable:    systemctl disable --now autofirmer-publish.timer"