feat(trade-executor): Slack bot-token transport + semver image tags

Two changes that ship together so a single CI run lands both:

1) SlackNotifier — support bot-token + channel transport
   - Previous version only supported a pinned webhook URL.
   - New mode uses chat.postMessage with bot_token + channel.
   - Channel can be changed via env var without rotating webhooks.
   - bot-token transport wins when both are set.
   - Fail-soft: ok=false (e.g. channel_not_found if the user
     hasn't created #trading-bot yet) is logged + skipped, not
     raised.
   - 5 new tests (10 total): bot-token wins, channel_not_found
     swallowed, headers/payload shape verified.

2) Image tags — switch from :${CI_PIPELINE_NUMBER} → :0.1.${N}
   - 3-part semver so Keel patch policy (cluster-wide default
     in inject-keel-annotations) is bounded to patch bumps
     within 0.1.x. Prior 1-part tags (:53) were technically
     parseable as major-only, which Keel patch wouldn't bump
     but could still resolve oddly under digest tracking.
   - Memory id=1935 documents Keel patch ≠ bulletproof for
     non-semver; semver tags are the safer mode.
   - update-deployment + verify-deploy steps updated to match.
   - :latest still pushed for cache-from + bootstrap.

services/trade_executor/main.py

@@ -204,10 +204,19 @@ async def run(config: TradeExecutorConfig | None = None) -> None:
     # --- Risk manager ---
     risk_manager = RiskManager(config, broker, redis=redis)
 
-    # --- Slack notifier (no-op when slack_webhook_url is empty) ---
-    slack_notifier = SlackNotifier(webhook_url=config.slack_webhook_url)
+    # --- Slack notifier (no-op when both transports are empty) ---
+    slack_notifier = SlackNotifier(
+        webhook_url=config.slack_webhook_url,
+        bot_token=config.slack_bot_token,
+        channel=config.slack_channel,
+    )
     if slack_notifier.enabled:
-        logger.info("Slack notifications enabled")
+        transport = "bot-token" if slack_notifier.uses_bot_token else "webhook"
+        logger.info(
+            "Slack notifications enabled (%s%s)",
+            transport,
+            f", channel=#{slack_notifier.channel}" if slack_notifier.uses_bot_token else "",
+        )
 
     # --- Database (for persisting trades) ---
     db_session_factory = None