refact(frank-dragoon): serve gates run on the shared gate library

The hand-written image/ck/tokenizer gates are require_image, require_bytes and
require_dir_files from scripts/lib/llm-gates.sh. The serve seam is unchanged
and still green (its podman stub now models `podman image exists`, the
primitive the gate uses). Behaviour preserved: every refusal names the
artifact, the endpoint and the fetch script.

tests/frank_dragoon_unit.bats

@@ -45,6 +45,13 @@ podman_stub() {
 #!/usr/bin/env bash
 case "$1" in
     images) printf '%s\n' "${STUB_DIGESTS:-}" ;;
+    image)
+        # `podman image exists REF` — exit 1 when storage lacks the ref,
+        # which is exactly the primitive the shared gate library calls.
+        case " ${STUB_DIGESTS:-} " in
+            *" $3 "*) exit 0 ;;
+            *)        exit 1 ;;
+        esac ;;
     rm)     exit 0 ;;
     run|wait) echo "PODMAN $*"; exit "${STUB_WAIT_RC:-0}" ;;
     *)      exit 0 ;;

tests/llm_gates.bats

@@ -130,6 +130,15 @@ call() {
     [[ "$output" == *"tokenizer: missing"* ]]
 }
 
+@test "the flat-directory gate refuses a symlinked directory" {
+    # The snapshot directory itself can be the link (a HF cache blobs/
+    # sibling), and a link into the container mount dangles there too.
+    ln -s "$TMP/flat" "$TMP/linked-dir"
+    call "require_dir_files '$TMP/linked-dir' tokenizer 'fetch the tokenizer' tokenizer.json"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"tokenizer: missing"* ]]
+}
+
 @test "the image gate refuses a ref the storage does not hold" {
     # A name@sha256 ref exists only if THAT manifest was pulled, so the
     # gate is the ref itself — one command, no grep race.