feat(frank-tts-engine): the arm A engine as a boot-persistent quadlet unit

Repo state only: nothing deployed, no host touched, no container started.

- `frank-tts-engine` on Dankclaw: `qwentts.cpp` commit
  5916bf7c79dbb4e66fc059cdc507a79a23a28bb4, resident `tts-server`, 1.7 B base
  talker Q4_K_M + Q8_0 tokenizer, container port 8880. It is deliberately NOT a
  fleet endpoint — `frank-tts` on 7772 is the endpoint consumers address.
- Publishes NOTHING. A host-loopback publish would have been useless to the
  façade (netavark DNATs published ports only, so a bridge container cannot
  reach a host loopback bind — the shape that 502'd hermes) and would have been
  the one LAN-reachable surface of an unauthenticated synthesiser. Both voice
  containers sit on one committed quadlet network, `frank-tts-engine.network`
  pinned to 10.89.5.0/24 (next free /24 after open-notebook's 10.89.4.0/24), and
  peers address the engine by container name. Diagnostics and the deployer's
  health gate run inside the netns (`podman exec`, `wait_container_healthy`).
- Cold-voice law honoured in the unit: the first request for a registered voice
  decodes its whole reference to snapshot codec state (6.2-8.0 s, first audio
  byte 5 530 ms), later ones restore in 0.5 ms, and the registry is memory-only.
  `ExecStartPost=-/usr/bin/podman exec frank-tts-engine /app/warm-voices.sh`
  with `TimeoutStartSec=900`; the `-` prefix keeps a failed warm from
  crash-looping the endpoint under `Restart=always`. It logs cold=/warm= per
  voice, so the under-a-second second request is proven on every boot.
- Thread law recorded: `tts-server` has no `--threads`; src/backend.h uses
  hardware_concurrency()/2, so a cpuset pin silently changes the thread count.
- Image builds from the pinned commit with the proven line (GGML_BLAS=OFF
  forced by this host, every GPU backend off, -j 8, no -DGGML_NATIVE because
  ggml defaults to -march=native for the building host). Two stages; the runtime
  stage COPYs both the entrypoint and the warmer, because a container that
  publishes nothing is reached with `podman exec`, not a port.
- `scripts/download-frank-tts-engine-qwentts.sh` fetches the two GGUFs with byte
  and LFS-oid checks (talker 1 219 245 248 B, tokenizer 291 150 624 B); the
  deployer gates on --verify-only instead of pulling 1.4 GiB mid-deploy.
- Registered in SERVICE_ORDER, DANKCLAW_SERVICES, the deploy-remote.sh dispatch,
  its pre-deploy requirement, deploy.sh's regex, the planner's path map (the
  whole `dankclaw/voiceservice/` tree mapped to nothing before this), and
  test-changed.sh ABOVE the `dankclaw/*.container` case whose `*` crosses `/`.
- New seam tests/frank_tts_engine.bats (19): the Quadlet generator's own output
  for network/publish/boot/warm shape, entrypoint argv driven from the tracked
  env file, the warmer against a stub tts-server over a real socket
  (registration keys, ref_text absent, late engine, hung synthesis, name
  refusal), the fetcher's verifier, the pinned cmake line, and both routing
  tables. Suite: 422 passed.
- Vault: [[Frank TTS Engine]] linked from the index; log.md entry for the day.

scripts/deploy-remote.sh

@@ -92,6 +92,7 @@ service_is_allowed() {
         dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|dankclaw:marreta|\
         dankclaw:open-notebook|\
         dankclaw:frank-dragoon|dankclaw:frank-zealot|\
+        dankclaw:frank-tts-engine|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
         dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:calibre-server|dankserver:plex|dankserver:tautulli|\
         dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
@@ -549,6 +550,14 @@ build_compose_image() {
             image="franksdank/$service:latest"
             containerfile="dankclaw/$service/Containerfile"
             ;;
+        frank-tts-engine)
+            # The arm A TTS engine (qwentts.cpp `tts-server`). Built from
+            # source at a pinned upstream commit, so the build needs network
+            # and the cfhash label below is what keeps an unchanged re-deploy
+            # offline: the clone only happens when this Containerfile changes.
+            image=franksdank/frank-tts-engine:latest
+            containerfile=dankclaw/voiceservice/Containerfile.engine
+            ;;
         *)
             return 0
             ;;
@@ -744,6 +753,54 @@ deploy_open_notebook() {
     wait_for_health open-notebook http://127.0.0.1:5056/health 180
 }
 
+# frank-tts-engine is the arm A TTS engine behind frank-tts: one Quadlet unit
+# plus the private bridge its unit defines (install_quadlet copies the sibling
+# frank-tts-engine.network — without that file the v1 generator refuses to
+# produce the container unit at all, the same trap documented above). The
+# façade that consumes it is a separate service on a separate port and a
+# separate handler.
+deploy_frank_tts_engine() {
+    # Weights BEFORE the build, and refuse rather than fetch. The payload is
+    # 1.4 GiB of GGUF with byte and sha256 checks; silently pulling it inside a
+    # deploy would turn a stalled network into a deploy that looks hung, and
+    # would hide which of the two failure modes the operator is in. The fetcher
+    # is idempotent, so re-running this handler after the fetch is cheap.
+    if ! scripts/download-frank-tts-engine-qwentts.sh --verify-only >/dev/null; then
+        echo "frank-tts-engine: the talker/tokenizer GGUFs are missing or wrong-sized under /home/dank/models/Qwen3-TTS-GGUF; run scripts/download-frank-tts-engine-qwentts.sh and re-deploy" >&2
+        return 1
+    fi
+
+    # Build first: Image= is a locally built tag with Pull=never, so the
+    # generator cannot start a container from it before it exists.
+    build_compose_image frank-tts-engine
+
+    install_quadlet frank-tts-engine dankclaw/voiceservice/quadlet frank-tts-engine
+    systemctl --user start frank-tts-engine-network.service
+    # No `systemctl --user enable` (generated Quadlet units cannot be enabled
+    # on this host); boot persistence is the [Install] section in the unit.
+    #
+    # `restart` blocks until the unit reaches started, which includes the
+    # ExecStartPost warm pass — a boot of this service is therefore already
+    # warm by the time the next line runs.
+    systemctl --user restart frank-tts-engine.service
+    # NOT wait_for_health: this container publishes nothing, so there is no URL
+    # the deployer can dial from the host. The unit's HealthCmd runs inside the
+    # container's own namespace, and podman's recorded health status is what the
+    # host can actually observe.
+    wait_container_healthy frank-tts-engine 150 || return 1
+
+    # The warmer runs a second time here on purpose. ExecStartPost carries a
+    # `-` prefix so a failed warm can never crash-loop the endpoint, which also
+    # means the unit cannot fail the deploy on it. This call is where a voice
+    # that did not warm becomes a deploy result, and where the per-voice
+    # cold=/warm= numbers land on the operator's console instead of only in the
+    # journal. The pass itself is idempotent and the second cold cost is gone:
+    # the voices are already warm, so this costs about a second per voice. It is
+    # exec-ed into the container for the same reason the health gate is: no host
+    # address exists.
+    podman exec frank-tts-engine /app/warm-voices.sh
+}
+
 deploy_comfyui() {
     # Build first: the unit's Image= resolves against local storage, so the
     # image has to exist before the generator starts a container from it.
@@ -1690,6 +1747,7 @@ deploy_service() {
         frank-dragoon) deploy_llm_dragoon ;;
         frank-zealot) deploy_llm_zealot ;;
         frank-archon) deploy_llm_archon ;;
+        frank-tts-engine) deploy_frank_tts_engine ;;
         hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
         romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
         jellyfin) deploy_jellyfin ;;