Make the public dashboard show real data + smoke-check it

Two real fixes that explain why https://ship.reb00t.io was empty:

1. The volume mount was nested: ~/.ship:/home/appuser put the
   container's ~/.ship/state at host's ~/.ship/.ship/state. Switched
   to ~/.ship/state:/home/appuser/.ship/state. deploy.sh now
   pre-creates ~/.ship/state/logs on the remote.

2. The daemon writes state on whatever host runs it (your mac), but
   the dashboard runs on test.k3rnel-pan1c.com — separate filesystem,
   empty DB. Added a state-sync step so the daemon rsyncs ~/.ship/state/
   to the remote after every tick (configurable via
   SHIP_STATE_SYNC_TARGET / SHIP_STATE_SYNC_SSH_PORT, both wired in
   .envrc). deploy.sh also syncs once inline so the brand-new public
   smoke check sees data on the first run.

Smoke kicker (.ship/smoke.sh) gains two assertions before its
ship-smoke kick: GET /health must return 2xx, and GET /api/projects
must return a non-empty list. Failures fail the deploy so claude in
ship-self's workflow gets a chance to fix them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>