feat(deploy): multi-stage Dockerfile producing four first-party images (deploy-B §6.1)

One Dockerfile, four named --target stages: rutster-engine (FOB),
rutster-brain (brain), rutster-edge (custom xcaddy + curated DNS plugins
cloudflare/route53/porkbun/hetzner/desec, duckdns excluded per spec §3.2),
rutster-allinone (s6-overlay v3 supervising caddy + FOB + brain +
valkey-server).

Builder pins rust:1.85-slim-bookworm (matches rust-toolchain.toml).
libopus-dev in builder, libopus0 in runtime (matches dev — spec §6.1
distro-over-static-bundled). Brain image gets libopus0 too: although the
brain never calls an opus symbol, the linker records NEEDED:libopus.so.0
because rutster-brain-realtime depends on rutster-media (spec ambiguity
resolved in this slice's plan README).

All-in-one vendors s6-overlay v3.2.0.0 (ISC) + uses upstream valkey/valkey
binary (COPY --from pattern, BSD-3). Bundled-binary licenses
aggregation-clean vs GPL-3 (Caddy Apache-2.0). No Rust crates touched;
cargo-deny unaffected.

s6-rc service definitions land in this commit (caddy/engine/brain/
valkey-database run scripts + dependency edges). The Caddyfile lands in
Task 3 (same PR); the image-build CI job (Task 7) runs after both.

Signed-off-by: Aaron D. Lee <himself@adlee.work>

deploy/s6-rc.d/brain/dependencies.d/engine

@@ -0,0 +1 @@
+# empty — brain waits for the engine before attempting the tap WS.

deploy/s6-rc.d/brain/run

@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: rutster-brain-realtime. Shares the engine's network
+# namespace (T1 solo variant — the all-in-one is a single container so
+# loopback IS shared). The brain binds 127.0.0.1:8082 — the FOB reaches it
+# via RUTSTER_TAP_URL=ws://127.0.0.1:8082.
+exec /usr/local/bin/rutster-brain-realtime

deploy/s6-rc.d/caddy/dependencies.d/engine

@@ -0,0 +1 @@
+# empty file — s6-rc reads the basename as the dependency name.

deploy/s6-rc.d/caddy/run

@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: caddy — the edge (ACME + TLS termination + WS proxy).
+# Depends on: engine (s6-rc starts the engine first per caddy/dependencies.d/engine).
+# User: root (caddy needs :80/:443).
+foreground { mkdir -p /data }
+exec /usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

deploy/s6-rc.d/engine/dependencies.d/valkey-database

@@ -0,0 +1,3 @@
+# empty — engine doesn't WAIT on valkey (it must boot even if valkey is down
+# per ADR-0005's fail-safe posture: EventSink counts-and-drops, never blocks).
+# The dependency just orders boot for consistent log sequencing.

deploy/s6-rc.d/engine/run

@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: rutster — the FOB. Runs the rutster binary (axum + media
+# thread + trunk WS + /metrics). Reads its env from the container env
+# directly (s6-overlay v3 inherits container env via s6-overlay-envdir —
+# this slice relies on the container env for simplicity; the per-service
+# env files are a future hardening step).
+exec /usr/local/bin/rutster

deploy/s6-rc.d/valkey-database/dependencies.d/engine

@@ -0,0 +1 @@
+# empty — orders valkey after engine in boot sequence.

deploy/s6-rc.d/valkey-database/run

@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: valkey-server — bus + KV + presence (ADR-0005). Dark on
+# day one except EventSink consumer; the operator contract (volumes, ports,
+# upgrade shape) is stable so the spend ledger + fleet directory land later
+# without changing the deployment shape (spec §2.1).
+foreground { mkdir -p /var/lib/valkey }
+exec /usr/local/bin/valkey-server --dir /var/lib/valkey --save 60 1 --appendonly yes