feat: single-node Zopu runtime deployment for Debian

Lane D deliverable: reproducible execution-plane deployment on a fresh
Debian dedicated server (~12 cores, 40 GB RAM, single-node).

Artifacts:
- bootstrap.sh: Docker Engine, Bun, repo clone, build, systemd install,
  firewall (deny-by-default), optional Tailscale, disk monitor cron
- .env.template: all 8 environment groups documented (Convex, Gitea,
  model gateway, AgentOS/RivetKit, Zopu agent, daemon, Docker sandbox,
  service auth)
- systemd units: zopu-daemon, zopu-agent (both Restart=always),
  zopu-health timer (60s), zopu-docker-cleanup timer (daily)
- scripts: health-check, update, rollback, docker-cleanup, disk-monitor
- Caddyfile: optional reverse proxy (documentation-only by default)
- README.md: full runbook with start/stop/log/update/rollback/cleanup
  procedures, topology documentation, and boundary notes

Verified topology (from installed RivetKit source):
- registry.start() boots an in-process RivetKit engine (envoy mode) with
  a native Rust sidecar at http://localhost:6420 (DEFAULT_ENDPOINT in
  chunk-YDUQHING.js line 4751). createClient() connects back to it.
- No separate Rivet Engine process required for single-node operation.
- Linux x64 sidecar packages (@rivet-dev/agentos-sidecar-linux-x64-gnu)
  are available as optional dependencies.

Docker / Orb boundary:
- Docker Engine installed and zopu user in docker group.
- No Docker-backed sandbox code wired; Orb lane contract not yet landed.
- Volume pruning omitted from docker-cleanup.sh to protect durable data.

Validated: bash -n on all 6 shell scripts; mocked health-check smoke
(nc-based TCP probes, mocked systemctl/docker); systemd unit structural
checks. No JS/TS/agent files changed.

deploy/zopu-runtime/systemd/zopu-agent.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=Zopu Agent Service (Flue Node server)
+After=network-online.target zopu-daemon.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=__SERVICE_USER__
+Group=__SERVICE_USER__
+WorkingDirectory=__INSTALL_DIR__/packages/agents
+
+EnvironmentFile=__INSTALL_DIR__/.env
+
+# Flue build output: packages/agents/dist/server.mjs
+# Listens on PORT (default 3583 per .env.template).
+ExecStart=/usr/local/bin/bun dist/server.mjs
+
+Restart=always
+RestartSec=10
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=zopu-agent
+
+# Resource limits
+MemoryMax=8G
+CPUWeight=80
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

deploy/zopu-runtime/systemd/zopu-daemon.service

@@ -0,0 +1,40 @@
+[Unit]
+Description=Zopu Daemon (Bun/Effect + AgentOS/RivetKit)
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=__SERVICE_USER__
+Group=__SERVICE_USER__
+WorkingDirectory=__INSTALL_DIR__
+
+EnvironmentFile=__INSTALL_DIR__/.env
+
+# RivetKit in-process engine: envoy mode (serverful).
+# registry.start() boots the native Rust sidecar and actor envoy.
+# RIVET_ENDPOINT defaults to http://localhost:6420 inside the daemon process.
+ExecStart=__INSTALL_DIR__/apps/daemon/dist/code-daemon
+
+Restart=always
+RestartSec=10
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=zopu-daemon
+
+# Resource limits (12-core, 40 GB host)
+MemoryMax=8G
+CPUWeight=100
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+
+# Docker socket access (for future Orb sandboxes; group membership required)
+SupplementaryGroups=docker
+
+[Install]
+WantedBy=multi-user.target

deploy/zopu-runtime/systemd/zopu-docker-cleanup.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Zopu Docker Cleanup
+After=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=__INSTALL_DIR__/deploy/zopu-runtime/scripts/docker-cleanup.sh

deploy/zopu-runtime/systemd/zopu-docker-cleanup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Zopu Docker Cleanup (daily)
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/zopu-runtime/systemd/zopu-health.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Zopu Health Check
+
+[Service]
+Type=oneshot
+User=__SERVICE_USER__
+EnvironmentFile=__INSTALL_DIR__/.env
+ExecStart=__INSTALL_DIR__/deploy/zopu-runtime/scripts/health-check.sh --quiet

deploy/zopu-runtime/systemd/zopu-health.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Zopu Health Check (every 60s)
+
+[Timer]
+OnBootSec=30
+OnUnitActiveSec=60
+AccuracySec=5
+
+[Install]
+WantedBy=timers.target