refact(deployer): one MainPID gate for all three LLM endpoints

frank-dragoon's health gate never checked WHO answered :7770 — the
false-green the fleet learned about on 2026-09-26 (a stray probe holding
the port satisfies a bare curl while the unit is stopped). The other two
handlers carried that check as inlined copies; all three now call
assert_unit_owns_port, and dragoon gets the protection it was missing.

The seam follows: the endpoints' text-grep deployer tests are deleted,
because tests/llm_deploy_gates.bats EXECUTES the same handlers end to end
(stub systemctl/podman/sudo/ss/curl) and asserts refusals, restarts, unit
links, the pending marker, and the MainPID hardening. GATE_PREFIX is
exported at each handler for the same reason the serve scripts export it.

tests/deploy_sandbox.bash

@@ -64,10 +64,13 @@ sandbox_setup() {
 
     # $HOME/serverAppConfigs is the checkout the handler works in: a git
     # WORKTREE of the caller's checkout, so the handler runs the EXACT files
-    # under test (the suite lives in worktrees, where uncommitted state is
-    # the norm), and it is a real git repo: the deployer refuses a revision
+    # under test, and it is a real git repo: the deployer refuses a revision
     # it cannot resolve. The handler cds into REMOTE_DIR, so every relative
     # path it uses resolves there.
+    #
+    # HEAD is committed state, so the seam asserts on what is in history —
+    # the same rule as the whole suite, and the reason an uncommitted
+    # deployer change is invisible here until it is committed.
     git -C "$repo_root" worktree add -q --detach "$HOME/serverAppConfigs" HEAD
     export REMOTE_DIR="$HOME/serverAppConfigs"