feat(inventory): one service inventory drives planner, allow-lists, and seams

rank 3. shared/services.yml is the single source of truth for every
deployable service (hosts, unit dirs, units, path claims, tests, scrape/
dns/probe facts, aliases, stacks); scripts/service-map.py is its only
reader (hosts/services/allows/plan/seams/owner/units/stack/get/render/
check). deploy-plan.py becomes a thin CLI wrapper; both --service
allow-lists (deploy.sh, deploy-remote.sh) and the changed-test mapper are
the inventory. Selection semantics: host scoping (a host's tree selects
only its own services), the quadlet netns/network coupling graph resolved
across directories (gluetun's riders live in their own dirs), stacks, and
canonical restart order.

Against the pinned old-planner fixture: 921 raw deltas reduced to 17, all
intentional (anubis now maps; cross-host paths select nothing; the retired
qwen-sharp template plans nothing and the live froggeric template plans
frank-archon; dankserver/romm/romm.container, missed by the old filename
rule, plans the romm trio). The fixture is regenerated as the new pin.

Integrity gates: schema, unit claims, quadlet-file ownership, path-glob
liveness, Pi-hole hosts / Prometheus jobs / DNS / homepage probes drift.
tests/service_inventory.bats pins all of it plus the plan fixture and the
deploy-plan CLI. Allow-list grep seams in hermes_webui/observability_quadlet
become behavioral allows calls.

tests/changed_tests.bats

@@ -13,11 +13,15 @@ load helpers
     [ "$status" -eq 0 ]
 }
 
-@test "changed-test wrapper maps a compose change to compose and environment tests" {
-    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths dankserver/compose.yaml
+@test "changed-test wrapper maps a shared config change to its service seams" {
+    # The compose era is retired (rank 7): the former compose fixture here
+    # mapped dankserver/compose.yaml, a file that no longer exists. The
+    # equivalent contract now: a service config change maps to the
+    # service's seams and nothing unrelated.
+    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths shared/searxng/settings.yml
     [ "$status" -eq 0 ]
-    [[ "$output" == *"tests/compose_validity.bats"* ]]
-    [[ "$output" == *"tests/env_consistency.bats"* ]]
+    [[ "$output" == *"tests/searxng_limiter.bats"* ]]
+    [[ "$output" == *"tests/searxng_quadlet.bats"* ]]
     [[ "$output" != *"tests/homepage_pages.bats"* ]]
 }
 
@@ -47,3 +51,27 @@ load helpers
     [[ "$output" != *"tests/frank_medium_unit.bats"* ]]
     [[ "$output" != *"tests/frank_archon_unit.bats"* ]]
 }
+
+@test "changed-test wrapper maps the frankbook unit to the frankbook and deploy-flow seams" {
+    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths frankbook-pro/sonarr/quadlet/sonarr.container
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"tests/frankbook_quadlet.bats"* ]]
+    [[ "$output" == *"tests/deployment_flow.bats"* ]]
+    [[ "$output" == *"tests/deployment_scoping.bats"* ]]
+    [[ "$output" != *"tests/frank_archon_unit.bats"* ]]
+}
+
+@test "changed-test wrapper maps the inventory itself to its seam" {
+    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths shared/services.yml
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"tests/service_inventory.bats"* ]]
+    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths scripts/service-map.py
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"tests/service_inventory.bats"* ]]
+}
+
+@test "changed-test wrapper refuses an unmapped path" {
+    run bash "$REPO_ROOT/scripts/test-changed.sh" --list --paths newdir/file.txt
+    [ "$status" -eq 2 ]
+    [[ "$output" == *"no focused-test mapping"* ]]
+}