Add opt-in auto-update from Gitea releases

The program now lives in /usr/local/lib/bamboo and is owned by its service user so it can replace itself.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/bamboo.service

@@ -8,7 +8,7 @@ Wants=network-online.target
 User=bamboo
 Group=bamboo
 EnvironmentFile=-/etc/bamboo/bamboo.env
-ExecStart=/usr/local/bin/bamboo -data /var/lib/bamboo
+ExecStart=/usr/local/lib/bamboo/bamboo -data /var/lib/bamboo
 WorkingDirectory=/var/lib/bamboo
 Restart=on-failure
 RestartSec=3
@@ -16,7 +16,7 @@ RestartSec=3
 # It makes outbound connections only, so it needs no privileges at all.
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/bamboo
+ReadWritePaths=/var/lib/bamboo /usr/local/lib/bamboo
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true