Commit challs.txt once a day at 04:00, separate from the HedgeDoc refresh

The 30-minute timer now only updates the HedgeDoc note; a new
ctf-challs.timer runs --challs daily at 04:00. Locks are per target so
the two runs can overlap without one skipping.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ctf-challs.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Refresh challs.txt in the deployment repo once a day at 04:00
+
+[Timer]
+OnCalendar=*-*-* 04:00:00
+AccuracySec=1min
+# catch up on the last run if the machine was down when it was due
+Persistent=true
+
+[Install]
+WantedBy=timers.target