feat(trade-executor): Slack bot-token transport + semver image tags

Two changes that ship together so a single CI run lands both:

1) SlackNotifier — support bot-token + channel transport
   - Previous version only supported a pinned webhook URL.
   - New mode uses chat.postMessage with bot_token + channel.
   - Channel can be changed via env var without rotating webhooks.
   - bot-token transport wins when both are set.
   - Fail-soft: ok=false (e.g. channel_not_found if the user
     hasn't created #trading-bot yet) is logged + skipped, not
     raised.
   - 5 new tests (10 total): bot-token wins, channel_not_found
     swallowed, headers/payload shape verified.

2) Image tags — switch from :${CI_PIPELINE_NUMBER} → :0.1.${N}
   - 3-part semver so Keel patch policy (cluster-wide default
     in inject-keel-annotations) is bounded to patch bumps
     within 0.1.x. Prior 1-part tags (:53) were technically
     parseable as major-only, which Keel patch wouldn't bump
     but could still resolve oddly under digest tracking.
   - Memory id=1935 documents Keel patch ≠ bulletproof for
     non-semver; semver tags are the safer mode.
   - update-deployment + verify-deploy steps updated to match.
   - :latest still pushed for cache-from + bootstrap.

tests/services/trade_executor/test_slack_notifier.py

@@ -108,6 +108,55 @@ class TestSlackNotifierTradePost:
             await notifier.notify_trade(_signal(), _filled_order())
 
 
+class TestSlackNotifierBotToken:
+    @pytest.mark.asyncio
+    async def test_bot_token_calls_chat_postmessage(self):
+        notifier = SlackNotifier(bot_token="xoxb-test", channel="trading-bot")
+        assert notifier.uses_bot_token
+        with patch("httpx.AsyncClient") as mock_client_cls:
+            mock_client = AsyncMock()
+            mock_resp = AsyncMock()
+            mock_resp.json = lambda: {"ok": True, "ts": "1.2"}
+            mock_client.post = AsyncMock(return_value=mock_resp)
+            mock_client_cls.return_value.__aenter__.return_value = mock_client
+            await notifier.notify_trade(_signal(), _filled_order())
+        url = mock_client.post.call_args.args[0]
+        assert url == "https://slack.com/api/chat.postMessage"
+        kwargs = mock_client.post.call_args.kwargs
+        assert kwargs["headers"]["Authorization"] == "Bearer xoxb-test"
+        body = kwargs["json"]
+        assert body["channel"] == "trading-bot"
+        assert "NVDA" in body["text"]
+
+    @pytest.mark.asyncio
+    async def test_bot_token_swallows_channel_not_found(self):
+        """When the user hasn't created #trading-bot yet, the API returns
+        ok=false / error=channel_not_found. We log and continue."""
+        notifier = SlackNotifier(bot_token="xoxb-test", channel="nonexistent")
+        with patch("httpx.AsyncClient") as mock_client_cls:
+            mock_client = AsyncMock()
+            mock_resp = AsyncMock()
+            mock_resp.json = lambda: {"ok": False, "error": "channel_not_found"}
+            mock_client.post = AsyncMock(return_value=mock_resp)
+            mock_client_cls.return_value.__aenter__.return_value = mock_client
+            # should not raise
+            await notifier.notify_trade(_signal(), _filled_order())
+
+    @pytest.mark.asyncio
+    async def test_bot_token_wins_when_both_set(self):
+        notifier = SlackNotifier(
+            webhook_url="https://hooks.slack.test/abc",
+            bot_token="xoxb-test",
+            channel="trading-bot",
+        )
+        with patch("httpx.AsyncClient") as mock_client_cls:
+            mock_client = AsyncMock()
+            mock_client.post = AsyncMock(return_value=AsyncMock(json=lambda: {"ok": True}))
+            mock_client_cls.return_value.__aenter__.return_value = mock_client
+            await notifier.notify_trade(_signal(), _filled_order())
+        assert mock_client.post.call_args.args[0] == "https://slack.com/api/chat.postMessage"
+
+
 class TestSlackNotifierRejectionPost:
     @pytest.mark.asyncio
     async def test_rejection_post_calls_webhook(self):