Serial one-at-a-time test harness: builds under ukrrs-batch.slice,
ephemeral pg/redis/mysql per manifest addons, app driven by the real
CLOUDRON_* env contract. All resources labeled cloudron.grind=1 so
down/sweep cannot touch fleet containers. AGENTS.md documents the
per-package lifecycle (up/curl/logs/down/sweep) + host resource rules.
