deploy-agent: Rust deployment automation (server + stub + signed payloads)

- Workspace: common (protocol/crypto/tarball), server (axum+rustls), stub (registration, poll, verify-before-execute)
- Ed25519 payload signing + request-signature auth on /poll, /report
- flate2/miniz_oxide pure-Rust tarball, no system deps
- CI matrix: linux musl x86_64/aarch64, windows x86_64
- Compiles clean: cargo build --workspace, 0 errors 0 warnings

README.md

@@ -0,0 +1,54 @@
+# Deploy-Agent
+
+A secure deployment runner for automated system updates and change rollout.
+
+## Architecture
+
+- **Server**: Rust (axum), TLS (rustls+Let's Encrypt), per-machine instruction state, payload distribution
+- **Stub**: Rust, single static binary (musl for Linux), polls server via HTTPS (mTLS), executes signed payload tarballs
+- **Common**: All protocol, signatures, and tarball logic shared. Ed25519 for all signatures.
+
+## Threat Model / Security
+1. All instructions whitelisted (cannot push arbitrary shell — only allowed enum types)
+2. All payloads are Ed25519 signed (dalek). Each payload's tarball hash is signed — must verify signature before extraction/execution.
+3. All transport is TLS 1.3: mTLS on all endpoints (client/server auth)
+4. Even with server compromise, unsigned payloads cannot be executed
+5. Linux builds: musl static. Windows: modern, rustls native.
+
+---
+
+## Build Instructions
+
+### Prereqs
+- Rust 1.73+ (for musl: `rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl`)
+- Let's Encrypt on server target
+
+### Build all targets
+```sh
+cargo build --release --target x86_64-unknown-linux-musl
+cargo build --release --target aarch64-unknown-linux-musl
+cargo build --release --target x86_64-pc-windows-gnu
+```
+
+### Running the Server
+
+1. Update the Acme domain in `server/src/api.rs:build_tls` for your domain
+2. Start server:
+   ```sh
+   cd server && cargo run --release
+   ```
+3. mTLS provisioning writes certs to acme cache dir
+
+### Running the Stub
+
+1. Copy server public key to config directory or use auto-provision
+2. On first run, the stub registers itself, generates an Ed25519 keypair (machine identity)
+3. Configuration (~/.config/deploy-agent/config.toml or %APPDATA%)
+
+### Signing a Payload
+
+Follow the scripts in `payloads/sign-payload`. Instructions are in the comments — uses bash + Rust. You may also implement your own sign tool in Rust using common/crypto.
+
+---
+
+For technical details, see the code + `common/` for protocol. All types and serialization are shared. See `.gitea/workflows/build.yml` for CI config.