add chall tracker to deployment

README.md

@@ -49,6 +49,31 @@ the change live. Still `requests`-only, no new dependencies.
 `--hedgedoc <instance>` (POST a *new* note) is unrelated and only works where
 anonymous note creation is enabled — on `hedgedoc.cit.tum.de` it is not.
 
+## challs.txt for the deployment repo
+
+`--challs` commits the clone URL of every challenge at **Testing Ready or beyond**
+to `CHALLS_PATH` (default `2026/challs.txt`) in the deployment repo
+`CHALLS_REPO_URL`, one per line, the same format as last year's:
+
+```
+git@gitlab.lrz.de:h4tum-ctf/h4tum-ctf-2026/challenges/baby_rsa.git
+...
+```
+
+It only commits when the list actually changed, with a message naming what was
+added and removed (`Update 2026/challs.txt from challenge status: +jwt -safe`).
+A challenge that falls back below Testing Ready drops out again. Preview without
+committing:
+
+```sh
+./ctf_status.py -q --challs-out -
+```
+
+The token additionally needs **Repository: Read** and **Repository: Write** on the
+deployment project. If the branch is protected, the token's user must be allowed
+to push to it. Without `CHALLS_BRANCH`, the default branch is looked up, which
+also needs **Project: Read** there.
+
 ## Every 30 minutes, on a server
 
 Copy the repo to the server, create `ctf_status.env` there (it is gitignored, so it
@@ -75,7 +100,7 @@ The timer fires at `:00` and `:30` with up to a minute of jitter, and
 works too, if you would rather:
 
 ```
-*/30 * * * * /path/to/planner/ctf_status.py --update --quiet
+*/30 * * * * /path/to/planner/ctf_status.py --update --challs --quiet
 ```
 
 `--quiet` keeps a successful run silent, so you only hear about it when the note