deploy slice B + F: deploy/ artifacts + image-build + container smoke CI + tag-push publish (#26)

Co-authored-by: Aaron D. Lee <himself@adlee.work>
Co-committed-by: Aaron D. Lee <himself@adlee.work>

deploy/s6-rc.d/brain/dependencies.d/engine

@@ -0,0 +1 @@
+# empty — brain waits for the engine before attempting the tap WS.

deploy/s6-rc.d/brain/run

@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: rutster-brain-realtime. Shares the engine's network
+# namespace (T1 solo variant — the all-in-one is a single container so
+# loopback IS shared). The brain binds 127.0.0.1:8082 — the FOB reaches it
+# via RUTSTER_TAP_URL=ws://127.0.0.1:8082.
+exec /usr/local/bin/rutster-brain-realtime

deploy/s6-rc.d/caddy/dependencies.d/engine

@@ -0,0 +1 @@
+# empty file — s6-rc reads the basename as the dependency name.

deploy/s6-rc.d/caddy/run

@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: caddy — the edge (ACME + TLS termination + WS proxy).
+# Depends on: engine (s6-rc starts the engine first per caddy/dependencies.d/engine).
+# User: root (caddy needs :80/:443).
+foreground { mkdir -p /data }
+exec /usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

deploy/s6-rc.d/engine/dependencies.d/valkey-database

@@ -0,0 +1,3 @@
+# empty — engine doesn't WAIT on valkey (it must boot even if valkey is down
+# per ADR-0005's fail-safe posture: EventSink counts-and-drops, never blocks).
+# The dependency just orders boot for consistent log sequencing.

deploy/s6-rc.d/engine/run

@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: rutster — the FOB. Runs the rutster binary (axum + media
+# thread + trunk WS + /metrics). Reads its env from the container env
+# directly (s6-overlay v3 inherits container env via s6-overlay-envdir —
+# this slice relies on the container env for simplicity; the per-service
+# env files are a future hardening step).
+exec /usr/local/bin/rutster

deploy/s6-rc.d/valkey-database/dependencies.d/engine

@@ -0,0 +1 @@
+# empty — orders valkey after engine in boot sequence.

deploy/s6-rc.d/valkey-database/run

@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: valkey-server — bus + KV + presence (ADR-0005). Dark on
+# day one except EventSink consumer; the operator contract (volumes, ports,
+# upgrade shape) is stable so the spend ledger + fleet directory land later
+# without changing the deployment shape (spec §2.1).
+foreground { mkdir -p /var/lib/valkey }
+exec /usr/local/bin/valkey-server --dir /var/lib/valkey --save 60 1 --appendonly yes