Split ctf_status.py into a tracker package, config from .env only

ctf_status.py is now just the command line; the work lives in tracker/.
The rules that decide whether a challenge is believed are in
tracker/checks.py, one function per rule, listed in README_CHECKS and
REPO_CHECKS. Output is unchanged.

Read the config from .env only (ctf_status.env.example -> .env.example),
let single_run_lock() hold its own lock files, and rewrite the README as
a short overview of what the repo does and how to run it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

install-timer.sh

@@ -1,27 +1,21 @@
 #!/usr/bin/env sh
 # Install the 30-minute HedgeDoc refresh and the daily 04:00 challs.txt commit
 # as systemd *user* units.
-# Run it as the user that owns ctf_status.env / .env, on the machine that should do the
-# polling. Re-running it is safe; it just overwrites the units.
+# Run it as the user that owns .env, on the machine that should do the polling.
+# Re-running it is safe; it just overwrites the units.
 set -eu
 
 dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
 units="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
+env="$dir/.env"
 
 [ -x "$dir/ctf_status.py" ] || { echo "no executable ctf_status.py in $dir" >&2; exit 1; }
-# ctf_status.py reads ctf_status.env and .env; either (or both) will do
-set --
-for f in "$dir/ctf_status.env" "$dir/.env"; do
-    if [ -f "$f" ]; then set -- "$@" "$f"; fi
-done
-[ $# -gt 0 ] || {
-    echo "no ctf_status.env or .env in $dir — copy ctf_status.env.example to one first" >&2
-    exit 1; }
+[ -f "$env" ] || { echo "no .env in $dir — copy .env.example to .env first" >&2; exit 1; }
 # the timers run --update and --challs, which need these two
 for key in HEDGEDOC_NOTE CHALLS_REPO_URL; do
-    grep -qi "^$key=..*" "$@" || { echo "set $key=... in $* first" >&2; exit 1; }
+    grep -qi "^$key=..*" "$env" || { echo "set $key=... in $env first" >&2; exit 1; }
 done
-chmod 600 "$@"
+chmod 600 "$env"
 
 mkdir -p "$units"
 for u in ctf-status.service ctf-status.timer ctf-challs.service ctf-challs.timer; do