ci: pull-based deploy to the Pi via rolling dev release

The Pi is on a closed travel-router LAN, so push-based deploy from a
runner can't reach it. Switch to pull: the runner builds + publishes,
the Pi fetches.

- build-dev.yaml: after the arm64 build, publish the binary + sha256 +
  version.txt to a rolling "dev" Gitea release (replaces the
  upload-artifact + repository_dispatch -> deploy-dev hop)
- remove deploy-dev.yaml (push/scp-based deploy no longer used)
- scripts/pi-update.sh: poll the dev release, verify sha256, install via
  deploy.sh (backup/restart/rollback); only updates when version changes
- scripts/remoterig-update.{service,timer}: run the updater every 5 min
- setup-pi.sh: install deploy.sh + pi-update.sh + update.env template +
  the updater timer; summary now reflects the pull flow
- README: document the pull-based CI/CD; fix stale GOARM=6 (Zero 2 W is
  arm64 on 64-bit OS / arm GOARM=7 on 32-bit)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -117,31 +117,39 @@ Platform: pi-zero-2w (max 16 cameras)
 RemoteRig hub ready
 ```
 
-## Building for Raspberry Pi Zero 2 W
+## Deployment (CI/CD — pull-based)
 
-Cross-compile from your development machine:
+Deploys are automated and pull-based, so nothing has to reach into the closed
+RemoteRig network:
+
+1. **Push to `dev`** → Gitea Actions (`.gitea/workflows/build-dev.yaml`) builds the
+   React frontend and cross-compiles the Go hub for **arm64**.
+2. The workflow publishes the binary + `sha256` + `version.txt` to a rolling
+   **`dev` release**.
+3. On the Pi, `remoterig-update.timer` runs `scripts/pi-update.sh` every few
+   minutes: it compares versions, downloads + verifies the checksum, and installs
+   via `scripts/deploy.sh` (backup → restart → rollback on failure).
+
+First-time Pi setup (`sudo scripts/setup-pi.sh`) installs Mosquitto, the
+`remoterig` service, and the updater timer. If the repo is private, set a read
+token in `/opt/remoterig/update.env`.
+
+### Manual / local cross-compile
+
+The Pi Zero 2 W is a Cortex-A53 (ARMv8) running 64-bit Raspberry Pi OS, so the
+target is **arm64**:
 
 ```bash
-GOOS=linux GOARCH=arm GOARM=6 go build -o remoterig-hub ./cmd/server/
-```
-
-Copy the binary and `config.yaml` to your Pi:
-
-```bash
-scp remoterig-hub config.yaml pi@raspberrypi:/home/pi/remoterig/
-```
-
-Then run on the Pi:
-
-```bash
-./remoterig-hub
+GOOS=linux GOARCH=arm64 go build -o remoterig-hub ./cmd/server/
+scp remoterig-hub config.yaml pi@192.168.8.56:/opt/remoterig/
 ```
 
 ### Build Matrix
 
 | Target | Command |
 | ------ | ------- |
-| Raspberry Pi Zero 2 W | `GOOS=linux GOARCH=arm GOARM=6 go build -o remoterig-hub ./cmd/server/` |
+| Raspberry Pi Zero 2 W (64-bit OS) | `GOOS=linux GOARCH=arm64 go build -o remoterig-hub ./cmd/server/` |
+| Raspberry Pi (32-bit OS) | `GOOS=linux GOARCH=arm GOARM=7 go build -o remoterig-hub ./cmd/server/` |
 | Local (same arch) | `go build -o remoterig-hub ./cmd/server/` |
 | Linux amd64 | `GOOS=linux GOARCH=amd64 go build -o remoterig-hub ./cmd/server/` |