Split ctf_status.py into a tracker package, config from .env only

ctf_status.py is now just the command line; the work lives in tracker/.
The rules that decide whether a challenge is believed are in
tracker/checks.py, one function per rule, listed in README_CHECKS and
REPO_CHECKS. Output is unchanged.

Read the config from .env only (ctf_status.env.example -> .env.example),
let single_run_lock() hold its own lock files, and rewrite the README as
a short overview of what the repo does and how to run it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tracker/challs.py

@@ -0,0 +1,17 @@
+"""challs.txt for the deployment repo: what infra deploys."""
+from __future__ import annotations
+
+from .overview import Overview
+
+
+def render_challs(ov: Overview) -> str:
+    """One clone URL per line, for everything that is Testing Ready or beyond
+    and not blocked."""
+    return "".join(f"{c.repo.ssh_url}\n" for c in ov.testable)
+
+
+def challs_message(old: str, new: str, path: str) -> str:
+    name = lambda u: u.rsplit("/", 1)[-1].removesuffix(".git")
+    was, now = set(old.split()), set(new.split())
+    parts = [f"+{name(u)}" for u in sorted(now - was)] + [f"-{name(u)}" for u in sorted(was - now)]
+    return f"Update {path} from challenge status" + (f": {' '.join(parts)}" if parts else "")