feat(deploynotify): DM owner once per new deployed git SHA

New internal/deploynotify package fires a single Telegram DM to
BOT_OWNER_ID on the first cold start that observes a new gitSHA.
Dedup via a DynamoDB KV record so repeat cold starts of the same
version stay silent. Send-then-write order means a failed Telegram
call doesn't permanently silence retries.

gitSHA is baked into the binary via `-ldflags "-X main.gitSHA=..."`
from Makefile; empty SHA (non-make builds) silently disables the
feature. No new env vars or IAM permissions.

cmd/server/main.go

@@ -16,6 +16,7 @@ import (
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	"github.com/tiennm99/miti99bot/internal/ai"
+	"github.com/tiennm99/miti99bot/internal/deploynotify"
 	"github.com/tiennm99/miti99bot/internal/log"
 	"github.com/tiennm99/miti99bot/internal/metrics"
 	"github.com/tiennm99/miti99bot/internal/modules"
@@ -31,6 +32,11 @@ import (
 	"github.com/tiennm99/miti99bot/internal/telegram"
 )
 
+// gitSHA is populated at build time via `-ldflags "-X main.gitSHA=<sha>"`
+// (see Makefile). Empty value means the binary was built without that flag —
+// deploynotify treats it as a signal to stay silent.
+var gitSHA string
+
 // factories is the static module catalog. Adding a new module is a one-line
 // change here. Lives in main rather than the modules package to avoid an
 // import cycle (modules → util → modules).
@@ -124,6 +130,13 @@ func main() {
 		log.Warn("CRON_SHARED_SECRET unset; /cron/{name} disabled (404 to all)")
 	}
 
+	deploynotify.Run(rootCtx, deploynotify.Config{
+		Bot:     b,
+		KV:      provider.For("deploynotify"),
+		OwnerID: cfg.BotOwnerID,
+		GitSHA:  gitSHA,
+	})
+
 	handler := server.New(server.Config{
 		Bot:           b,
 		Registry:      reg,