Generic host/repo/branch-aware CD on adnanh/webhook

Replaces the per-project deploy scripts and self-contained webhook
receivers with one manifest-driven implementation that lives outside the
application repositories and can be updated independently of them.

First targets: domaindingo test and prod on s5.

etc/cd-webhook.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=Continuous deployment webhook receiver (adnanh/webhook)
+Documentation=https://github.com/adnanh/webhook
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+
+# Placeholders are substituted by install/install.sh from targets.json.
+# -hotreload picks up a re-rendered hooks file without a restart, so adding an
+# environment is `cd-render-hooks` and nothing else.
+# -nopanic keeps the daemon alive if the hooks file is momentarily unreadable
+# mid-write rather than exiting and taking every other target down with it.
+ExecStart=@WEBHOOK_BIN@ \
+    -hooks @HOOKS_FILE@ \
+    -ip @BIND@ \
+    -port @PORT@ \
+    -hotreload \
+    -nopanic
+
+Restart=on-failure
+RestartSec=5s
+
+# The deploy itself is a child process that talks to the user's Docker socket,
+# so this stays deliberately unsandboxed apart from the cheap wins below.
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+
+[Install]
+WantedBy=default.target