feat(install): read-only deploy token for the private package registry (v0.1.2)

The GitLab project is private (its parent groups are private, so it cannot be
made public): the v0.1.1 one-liner answered 401 anonymously. install.sh gains
--token / MONKY_DEPLOYD_TOKEN and sends `DEPLOY-TOKEN: <token>` (a GitLab deploy
token, scope read_package_registry only, revocable) on every registry download,
the script itself included; the token goes through a 0600 curl -K file (never the
command line, the log or an xtrace). The grant is taken via --bootstrap-file when
the script is piped (stdin IS the script). Ansible: monky_deployd_download_token
(vaulted) -> DEPLOY-TOKEN header, no_log. Docs explain why, the token's scope and
the --source gitea alternative (split-horizon Gitea, cbs/iac#102).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

docs/OPERATIONS.md

@@ -88,14 +88,27 @@ the picker, nothing is retired automatically.
 
 ## Where the installer downloads from
 
-The primary source is the **scm.tikali.ai generic package registry** of this (public) project:
+The primary source is the **scm.tikali.ai generic package registry** of this project:
 `https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/<file>` for
-`monky-deployd_<ver>_amd64.deb`, `.sha256` and `install.sh`; the one-liner fetches the script from
-`https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh`.
-Inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (`10.10.0.175`), which
-has no HTTP ingress, so backend boxes cannot fetch from the Gitea mirror (cbs/iac#102). Off-estate,
-`install.sh --source gitea` (ansible: `monky_deployd_base_url`/`_deb_url`) uses the Gitea release
-instead. The tag pipeline publishes to both (`release`, `release:gitea`).
+`monky-deployd_<ver>_amd64.deb`, `.sha256` and `install.sh`. The project is **private** (its parent
+groups are private, so it cannot be made public): every fetch, the script itself included, sends the
+`DEPLOY-TOKEN` header with a read-only GitLab **deploy token** — scope `read_package_registry` only,
+nothing else (no repository, no API, no write); revocable at any time in the project's *Settings →
+Repository → Deploy tokens*. It lives in OpenBao at `monky/monky-tenancy/deployd-download` (key
+`token`); the monky-tenancy install kit carries it and passes `--token`, the ansible role sends it
+from the vaulted `monky_deployd_download_token`. The one-liner:
+
+```sh
+curl -sSf -H "DEPLOY-TOKEN: $T" https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/install.sh \
+  | sudo bash -s -- --env <id> --site <site> --token "$T" --bootstrap-file bootstrap.jwt
+```
+
+`install.sh` never prints the token (it goes through a 0600 curl `-K` file that is deleted after the
+download; xtrace is switched off). A 401 on the download means the token is missing, revoked or
+lacks the scope. Inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP
+(`10.10.0.175`), which has no HTTP ingress, so backend boxes cannot fetch from the Gitea mirror
+(cbs/iac#102). Off-estate, `install.sh --source gitea` (ansible: `monky_deployd_base_url`/`_deb_url`,
+no token) uses the Gitea release instead. The tag pipeline publishes to both (`release`, `release:gitea`).
 
 ## Publishing a release to Gitea by hand