feat(scripts): one artifact-gate library for the LLM endpoints

The serve scripts and the deployer each hand-wrote the same missing/truncated
artifact gates; the 2026-10-01 crash-loop was those twins disagreeing
mid-cutover. scripts/lib/llm-gates.sh is the single place the refusal lives:
require_file / require_bytes / require_min_mib / require_dir_files /
require_image, each returning 1 and naming the endpoint, the artifact and the
remedy. New seam tests/llm_gates.bats pins the contract at the arguments-in /
status-and-stderr-out boundary.

tests/helpers.bash

@@ -4,6 +4,12 @@
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
+# skip_if_no_podman — skip the test when podman is absent (the image gate
+# asks real storage a real question)
+skip_if_no_podman() {
+    command -v podman >/dev/null 2>&1 || skip "podman is not installed"
+}
+
 # yaml_parse_ok <file> — assert a compose file parses as valid YAML
 yaml_parse_ok() {
     python3 - "$1" <<'PYEOF'