feat: add one-click Deploy to Render support

Adds a Render Blueprint (render.yaml) and supporting pieces so nanobot can
be deployed to Render in one click, with persistent memory across deploys.

- render.yaml: web service + 1GB persistent disk mounted at
  /home/nanobot/.nanobot. Prompts for ANTHROPIC_API_KEY and
  NANOBOT_WEB_TOKEN at deploy time (sync: false).
- render-config.json: committed gateway config that wires secrets via
  ${VAR} placeholders (resolved at runtime). Nothing secret is committed.
- entrypoint.sh: adds a branch gated on RENDER=true that copies the config
  onto the mounted disk, chowns the root-owned mount, and drops to the
  non-root nanobot user via setpriv. Local (non-Render) path is unchanged.
- Dockerfile: COPY render-config.json; USER nanobot -> USER root so the
  entrypoint can chown the freshly-mounted disk before dropping privileges;
  add PYTHONUNBUFFERED/PYTHONFAULTHANDLER for diagnosable crash output.
- README.md: Deploy to Render button + section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

render.yaml

@@ -0,0 +1,42 @@
+# Render Blueprint — deploys nanobot's gateway + bundled WebUI as one web
+# service. Secrets are provided at deploy time as env vars (sync: false) and
+# resolved at runtime via the ${VAR} placeholders in render-config.json.
+# Nothing secret is stored in this repo.
+services:
+  - type: web
+    name: nanobot
+    runtime: docker
+    dockerfilePath: ./Dockerfile
+    dockerContext: .
+    # Render's Docker Command REPLACES the Dockerfile ENTRYPOINT (it is not
+    # appended to it), so invoke the entrypoint explicitly. When RENDER=true the
+    # entrypoint copies render-config.json onto the mounted disk at
+    # $HOME/.nanobot/config.json (so the runtime data_dir lands on the persistent
+    # disk), chowns the root-owned mount, drops to the non-root nanobot user, and
+    # appends the --config flag itself — so pass only `gateway` here.
+    dockerCommand: /usr/local/bin/entrypoint.sh gateway
+    plan: starter
+    healthCheckPath: /
+    envVars:
+      # Anthropic API key — powers the agent's LLM calls. Get one at
+      # https://console.anthropic.com/settings/keys
+      - key: ANTHROPIC_API_KEY
+        sync: false
+      # WebUI access secret — the gate for the public WebUI. Generate a strong
+      # random value (e.g. `openssl rand -hex 32`) and keep it private.
+      - key: NANOBOT_WEB_TOKEN
+        sync: false
+      # Port Render routes public traffic to; matches channels.websocket.port
+      # in render-config.json.
+      - key: PORT
+        value: 8765
+    # Persist sessions, memory, and the WebUI display transcripts across deploys.
+    # The entrypoint copies the config onto this mount, so nanobot's runtime
+    # data_dir (config_path.parent) resolves here too — keeping webui/ (chat
+    # history the UI renders), cron, media, and logs durable, not just session
+    # files. Starter / 1 GB is the lean default; history persistence needs this
+    # disk, not a bigger plan.
+    disk:
+      name: nanobot-data
+      mountPath: /home/nanobot/.nanobot
+      sizeGB: 1