chore: sync workspace — configs, docs, scripts, CI, pnpm, submodules

- Submodule pins: dbis_core, cross-chain-pmm-lps, mcp-proxmox (local, push may be pending), metamask-integration, smom-dbis-138
- Atomic swap + cross-chain-pmm-lops-publish, deploy-portal workflow, phoenix deploy-targets, routing/aggregator matrices
- Docs, token-lists, forge proxy, phoenix API, runbooks, verify scripts

Made-with: Cursor

phoenix-deploy-api/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.0.3
 info:
   title: Phoenix Deploy API / Phoenix API Railing
   description: |
-    Gitea webhook, deploy stub, and Phoenix API Railing (Infra, VE, Health).
+    Gitea webhook, deploy execution API, and Phoenix API Railing (Infra, VE, Health).
     Optional partner API key for /api/v1/* when PHOENIX_PARTNER_KEYS is set.
   version: 1.0.0
 
@@ -38,13 +38,16 @@ paths:
     post:
       tags: [Webhook]
       summary: Gitea webhook receiver
+      description: |
+        Validates webhook signatures when `PHOENIX_DEPLOY_SECRET` is set.
+        Executes the default deploy target only when `PHOENIX_WEBHOOK_DEPLOY_ENABLED=1`.
       requestBody:
         required: true
         content:
           application/json:
             schema: { type: object }
       responses:
-        '200': { description: Accepted }
+        '200': { description: Accepted or executed depending on webhook deploy mode }
         '400': { description: No payload }
         '401': { description: Invalid signature }
 
@@ -64,8 +67,17 @@ paths:
                 target: { type: string }
                 sha: { type: string }
       responses:
-        '202': { description: Accepted }
+        '200': { description: Deploy completed successfully }
         '401': { description: Unauthorized }
+        '404': { description: No matching deploy target }
+        '500': { description: Deploy command or health check failed }
+
+  /api/deploy-targets:
+    get:
+      tags: [Webhook]
+      summary: List configured deploy targets
+      responses:
+        '200': { description: Target list }
 
   /api/v1/public-sector/programs:
     get: