deploy: 9-account/2-host packaging + static release build (Redmine 494)

Everything needed for one ~10-minute Charles window on ultix-streaming
and ultix-offstage, with zero root/systemd on the target accounts:

- deploy/accounts.tsv: the fleet authority (account, host, vertical,
  Redmine project, quota group, ports). Port scheme events=4100+index,
  serve=8090+index with a global 0-8 index so per-account daemons on
  one host never collide; loop state is per-account under ~/.mopac.
- deploy/install-account.sh <account>: idempotent installer run AS the
  target user; renders harness.toml from deploy/harness.toml.in, writes
  a 0600 env-secrets template, refuses to overwrite existing config or
  secrets (re-run = the upgrade path), generates mopac-start/stop.
- deploy/runbook.md: exact Charles sequence (build, stage, install,
  secrets bootstrap, verify, start via nohup or cron @reboot, rollback)
  with the account-port table, per-host time estimates and assumptions.
- Makefile: release target (digest-pinned docker builder, CGO off,
  linux/amd64 static, stripped) plus check/deploy-test entrypoints.
- deploy/tests.sh: 13 packaging tests (TSV scheme, template substitution
  for all 9 accounts, idempotence, refuse-to-overwrite, binary lookup,
  rendered config loads via a dry-run); README deploy section.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

Makefile

@@ -0,0 +1,33 @@
+# MOPAC harness Makefile. Everything routes through the digest-pinned
+# Docker builder (DESIGN "ALL dev work in Docker"); the host runs
+# containers, never toolchains. dev.sh stays the dev entrypoint — the
+# targets here are the deploy-facing surface.
+
+IMAGE := golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514
+# = golang:1.26-bookworm (digest-pinned; alpine lacks bash for tests)
+
+.PHONY: release check deploy-test clean
+
+# Static linux/amd64 release binary for the 9-account deploy (Redmine
+# 494): CGO off -> no libc dependency, runs in any Linux account with
+# zero host packages. Output is gitignored (bin/).
+release:
+	docker run --rm -v "$(CURDIR):/h" -w /h \
+	  -u $$(id -u):$$(id -g) -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+	  -e CGO_ENABLED=0 -e GOOS=linux -e GOARCH=amd64 \
+	  $(IMAGE) go build -trimpath -ldflags='-s -w' \
+	    -o bin/harness-linux-amd64 ./cmd/harness
+	@file bin/harness-linux-amd64 2>/dev/null || ls -l bin/harness-linux-amd64
+
+# Pre-commit gate: build + vet + test, all inside the builder.
+check:
+	./dev.sh check
+
+# Deploy packaging tests: accounts.tsv scheme, template substitution,
+# installer idempotence + refuse-to-overwrite in a fake HOME.
+# (Pure shell, no docker needed — it tests the shell deliverables.)
+deploy-test:
+	./deploy/tests.sh
+
+clean:
+	rm -rf bin/harness bin/harness-linux-amd64