fix(frank-dragoon): stage the NPU lane inside the payload mount

The lane's first boot died at container init, not at the engine:

  runc create failed: ... create mountpoint for /models/npu mount:
  mkdirat .../merged/models/npu: read-only file system

The image ships no /models, and the serve script binds the payload dir
there read-only, so a nested `-v $NPU_DIR:/models/npu:ro` had to create
its own mountpoint underneath a read-only parent — impossible. The
engine's own entrypoint confirms the container path is fixed: it rejects
HALOGEN_NPU_DIR outright ("our NPU models live under /models/npu/<id>/").

Fix is the mount shape, not the engine: FRANK_DRAGOON_NPU_DIR now lives
inside FRANK_DRAGOON_MODEL_DIR, so the payload's single read-only mount
puts the files at /models/npu/<id>/ by itself and the nested bind is
gone. Verified on the running container: after the move, `podman exec
frank-dragoon-halogen ls /models/npu/qwen3-embedding-0.6b` answers with
the staged tree while the lane is still armed off.

Both gates refuse the old shape by name (serve + deployer parity) so a
future payload swap that moves the model dir cannot reintroduce a crash
that lands after the deployer has already stopped the running unit.

scripts/frank-dragoon.env

@@ -87,18 +87,24 @@ HALOGEN_WEIGHTS_LOCK=1
 # fabric-clock dependency, no /v1/embeddings). Rolling the lane back is blanking
 # this one line and re-deploying — nothing else moves.
 # Names are the vendor catalog's folder names (`/opt/halogen/npu/models.txt`
-# inside the image). The engine cannot fetch them here: /models is read-only and
+# inside the image) and the engine reads a model ONLY at /models/npu/<name>/ —
+# HALOGEN_NPU_DIR is gone from the image and setting it is a boot refusal.
+# The engine cannot fetch anything here: /models is read-only and
 # HALOGEN_DOWNLOAD stays unset so the container opens no outbound connection at
-# boot, so scripts/download-frank-dragoon-npu.sh must stage them into
-# $FRANK_DRAGOON_NPU_DIR first (the serve gate and the deployer both refuse by
-# name when a named model is not staged).
+# boot, so scripts/download-frank-dragoon-npu.sh must stage the files first
+# (the serve gate and the deployer both refuse by name when a named model is
+# missing). FRANK_DRAGOON_NPU_DIR therefore lives INSIDE the payload dir: the
+# payload mount is the container's only handle on /models, and runc cannot
+# mkdir a nested /models/npu mountpoint through a read-only bind — the lane's
+# first boot died on precisely that (2026-10-19). Swap the payload dir and this
+# path moves with it.
 # Cost: ~1.5 GiB extra pinned host RAM per named model, and a hard dependency on
 # the host holding the GPU fabric clock — on Strix Halo the iGPU and the NPU
 # together hang the machine (and corrupt NPU results) while FCLK changes speed,
 # so halogen refuses to start with this variable set unless the clock is held
 # (dankclaw/host/halogen-fabric-clock; the deployer installs and gates it).
 HALOGEN_NPU_MODELS=qwen3-embedding-0.6b
-FRANK_DRAGOON_NPU_DIR=/home/dank/models/halogen-npu
+FRANK_DRAGOON_NPU_DIR=/home/dank/models/halogen-v2-abliterated/npu
 # Node paths and the XRT directory are variables so the bats seam can drive
 # these gates on a box with no NPU. Ubuntu's distro XRT (libxrt2 + libxrt-npu2)
 # is mounted FILE BY FILE and TWICE EACH — once where the image looks for XRT,