feat(trade-executor): Slack bot-token transport + semver image tags

Two changes that ship together so a single CI run lands both:

1) SlackNotifier — support bot-token + channel transport
   - Previous version only supported a pinned webhook URL.
   - New mode uses chat.postMessage with bot_token + channel.
   - Channel can be changed via env var without rotating webhooks.
   - bot-token transport wins when both are set.
   - Fail-soft: ok=false (e.g. channel_not_found if the user
     hasn't created #trading-bot yet) is logged + skipped, not
     raised.
   - 5 new tests (10 total): bot-token wins, channel_not_found
     swallowed, headers/payload shape verified.

2) Image tags — switch from :${CI_PIPELINE_NUMBER} → :0.1.${N}
   - 3-part semver so Keel patch policy (cluster-wide default
     in inject-keel-annotations) is bounded to patch bumps
     within 0.1.x. Prior 1-part tags (:53) were technically
     parseable as major-only, which Keel patch wouldn't bump
     but could still resolve oddly under digest tracking.
   - Memory id=1935 documents Keel patch ≠ bulletproof for
     non-semver; semver tags are the safer mode.
   - update-deployment + verify-deploy steps updated to match.
   - :latest still pushed for cache-from + bootstrap.

.woodpecker.yml

@@ -33,8 +33,11 @@ steps:
       build_args:
         - SERVICE_MODULE=api_gateway
       cache_from: viktorbarzin/trading-bot-service:latest
+      # Semver tags: 0.1.${CI_PIPELINE_NUMBER}. Keel policy:patch is bounded
+      # to patch-level bumps within 0.1.x, no surprise tag rewrites to
+      # different major/minor. :latest kept for cache + bootstrap.
       tags:
-        - "${CI_PIPELINE_NUMBER}"
+        - "0.1.${CI_PIPELINE_NUMBER}"
         - latest
 
   - name: build-dashboard-image
@@ -50,7 +53,7 @@ steps:
       context: .
       cache_from: viktorbarzin/trading-bot-dashboard:latest
       tags:
-        - "${CI_PIPELINE_NUMBER}"
+        - "0.1.${CI_PIPELINE_NUMBER}"
         - latest
 
   - name: update-deployment
@@ -62,8 +65,8 @@ steps:
       - apk add --no-cache curl jq
       - |
         TOKEN=$$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-        SERVICE_IMAGE="viktorbarzin/trading-bot-service:${CI_PIPELINE_NUMBER}"
-        DASHBOARD_IMAGE="viktorbarzin/trading-bot-dashboard:${CI_PIPELINE_NUMBER}"
+        SERVICE_IMAGE="viktorbarzin/trading-bot-service:0.1.${CI_PIPELINE_NUMBER}"
+        DASHBOARD_IMAGE="viktorbarzin/trading-bot-dashboard:0.1.${CI_PIPELINE_NUMBER}"
         RESTART_AT=$$(date -u +%Y-%m-%dT%H:%M:%SZ)
         API="https://kubernetes:6443/apis/apps/v1/namespaces/trading-bot/deployments"
 
@@ -115,8 +118,8 @@ steps:
       - apk add --no-cache curl jq
       - |
         TOKEN=$$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-        EXPECTED_SERVICE="viktorbarzin/trading-bot-service:${CI_PIPELINE_NUMBER}"
-        EXPECTED_DASHBOARD="viktorbarzin/trading-bot-dashboard:${CI_PIPELINE_NUMBER}"
+        EXPECTED_SERVICE="viktorbarzin/trading-bot-service:0.1.${CI_PIPELINE_NUMBER}"
+        EXPECTED_DASHBOARD="viktorbarzin/trading-bot-dashboard:0.1.${CI_PIPELINE_NUMBER}"
         BASE_API="https://kubernetes:6443/api/v1/namespaces/trading-bot/pods"
         DEPLOY_API="https://kubernetes:6443/apis/apps/v1/namespaces/trading-bot/deployments"