feat: unified launcher, multi-OS hardening, login alerts & auto-updates

Restructure around a single entry point (automations.sh) with a Gum wizard and
a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the
provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on
Alpine/Debian/Alma; seed root keys from globals/.

- ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec
- daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and
  opt-in Alpine stable-branch upgrades
- generic + per-deployment cloud-init; Gitea release workflow on tag
- README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea

.gitea/workflows/release.yml

@@ -0,0 +1,41 @@
+# Gitea Actions: on a version tag (vX.Y.Z), build the self-extracting bundle
+# and publish it as a release asset. Make the release public (Gitea per-repo
+# setting) and the bundle is downloadable without granting repo access.
+#
+# Requirements:
+#   - A registered Gitea act_runner whose labels include the `runs-on` value
+#     below (adjust if yours differ, e.g. self-hosted).
+#   - A repo/org secret named TOKEN_GITEA holding a Gitea access token with
+#     write:repository scope (Settings -> Applications -> Generate Token).
+#     NOTE: Gitea reserves the GITEA_ prefix, so the name can't start with it;
+#     TOKEN_GITEA is fine.
+
+name: Release bundle
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  bundle:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history + tags)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build self-extracting bundle
+        run: |
+          bash build-bundle.sh "${GITHUB_REF_NAME}"
+          ls -l dist/
+
+      - name: Create release and attach the bundle
+        uses: https://gitea.com/actions/release-action@main
+        with:
+          files: |-
+            dist/automations-bundle.sh
+          api_key: '${{ secrets.TOKEN_GITEA }}'
+          # title/body default to the tag; uncomment to customize:
+          # title: 'automations ${{ github.ref_name }}'