docs(readme): source of truth is SQLite; add Deployment & updating section

- Blocklist source of truth is the SQLite ledger, not git history.
- data/mikrotik is a scratch mirror, not a git audit trail.
- Removed the 'commit blocklist files' advice.
- Added 'Deployment & updating (git pull)' section covering deploy.sh,
  runtime isolation, and python -m app.db --migrate (D008).

deploy/check_runtime_git.sh

@@ -40,7 +40,7 @@ fail=0
 #    changes), so unborn commits don't cause false failures.
 allowed="app/data/paloalto/scanner-ips.txt"
 tracked=$(git ls-files app/data app/reports)
-problem=$(printf '%s\n' "$tracked" | grep -v '^'"/\$allowed"'$' || true)
+problem=$(printf '%s\n' "$tracked" | grep -xvF "$allowed" || true)
 if [[ -n "$problem" ]]; then
   echo "FAIL: unexpected tracked files under runtime dirs:" >&2
   echo "$problem" >&2