refact(deployer): one MainPID gate for all three LLM endpoints

frank-dragoon's health gate never checked WHO answered :7770 — the
false-green the fleet learned about on 2026-09-26 (a stray probe holding
the port satisfies a bare curl while the unit is stopped). The other two
handlers carried that check as inlined copies; all three now call
assert_unit_owns_port, and dragoon gets the protection it was missing.

The seam follows: the endpoints' text-grep deployer tests are deleted,
because tests/llm_deploy_gates.bats EXECUTES the same handlers end to end
(stub systemctl/podman/sudo/ss/curl) and asserts refusals, restarts, unit
links, the pending marker, and the MainPID hardening. GATE_PREFIX is
exported at each handler for the same reason the serve scripts export it.

tests/frank_dragoon_unit.bats

@@ -335,11 +335,6 @@ $(cat "$TEST_TMP/serve.log")"
     grep -qF "LLM_DRAGOON_CKPT_BYTES=\"\${LLM_DRAGOON_CKPT_BYTES:-$bytes}\"" "$DEPLOYER"
 }
 
-@test "the deployer points a missing artifact at the flashnext fetch script" {
-    grep -qE 'download-frank-dragoon-flashnext\.sh' "$DEPLOYER"
-    grep -qE 'podman pull' "$DEPLOYER"
-}
-
 @test "the stray sweep cannot take frank-zealot or the deployer down" {
     # frank-zealot also listens on this host (7771, llama-server) and the
     # deployer's own command line contains "frank-dragoon"; only the FULL