Run the daemon on ubu (ship-daemon compose service)

Until now nothing was polling for new commits — the deployed `ship`
container only ran ship.web, so anything pushed to main sat there
until I happened to invoke `ship serve --once` from my mac. That's
why 36d0d9d + 2a5f57a stayed undeployed.

Adds a `ship-daemon` service to docker-compose.yml that runs
`ship serve` on the same host as the web app:

- Mounts `/var/run/docker.sock` (build + compose-up of ship-app),
  `~/.ssh:ro` (git push + ssh roundtrips back to its own host),
  `~/.claude` (claude credentials — already populated on ubu),
  `~/.ship/state` (shared with the web app, no rsync needed),
  `~/.ship/workspaces` (per-project working trees the daemon
  does git ops in), and `./ship.yaml` (the daemon's project list).
- Runs as root so it can talk to the host docker socket without
  group-membership gymnastics.
- Independent restart policy: deploy.sh now uses `docker compose
  up -d ship` (not the unscoped form), so a ship-self deploy that
  swaps the web image leaves the daemon untouched. Daemon updates
  need a manual `docker compose up -d ship-daemon` until self-
  replacement is solved.

Image gains the docker CLI, docker-compose-v2, and rsync. The
daemon's project paths (`/workspaces/<name>`) live in the new
config/ship.yaml, which deploy.sh scps to ~/ship/ship.yaml on
each run. Remote .env now also carries PUBLIC_URL and
NOTIFY_API_KEY so the daemon's deploy/notify steps work in-
container.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>