feat(trade-executor): Slack bot-token transport + semver image tags

Two changes that ship together so a single CI run lands both:

1) SlackNotifier — support bot-token + channel transport
   - Previous version only supported a pinned webhook URL.
   - New mode uses chat.postMessage with bot_token + channel.
   - Channel can be changed via env var without rotating webhooks.
   - bot-token transport wins when both are set.
   - Fail-soft: ok=false (e.g. channel_not_found if the user
     hasn't created #trading-bot yet) is logged + skipped, not
     raised.
   - 5 new tests (10 total): bot-token wins, channel_not_found
     swallowed, headers/payload shape verified.

2) Image tags — switch from :${CI_PIPELINE_NUMBER} → :0.1.${N}
   - 3-part semver so Keel patch policy (cluster-wide default
     in inject-keel-annotations) is bounded to patch bumps
     within 0.1.x. Prior 1-part tags (:53) were technically
     parseable as major-only, which Keel patch wouldn't bump
     but could still resolve oddly under digest tracking.
   - Memory id=1935 documents Keel patch ≠ bulletproof for
     non-semver; semver tags are the safer mode.
   - update-deployment + verify-deploy steps updated to match.
   - :latest still pushed for cache-from + bootstrap.

services/trade_executor/config.py

@@ -22,7 +22,12 @@ class TradeExecutorConfig(BaseConfig):
     kevin_equity_drawdown_halt_pct: float = 0.20  # 20% drawdown → permanent pause
     kevin_daily_loss_circuit_pct: float = 0.05  # 5% daily loss → 24h pause
 
-    # Slack webhook for per-trade notifications (empty → notifier no-ops).
+    # Slack notifications — pick ONE transport:
+    #   1. Bot token + channel (preferred) → chat.postMessage API
+    #   2. Webhook URL (legacy) → single-channel webhook
+    # If both set, bot-token wins. If neither, notifier is a no-op.
     slack_webhook_url: str = ""
+    slack_bot_token: str = ""
+    slack_channel: str = ""
 
     model_config = {"env_prefix": "TRADING_"}