feat(inventory): one service inventory drives planner, allow-lists, and seams

rank 3. shared/services.yml is the single source of truth for every
deployable service (hosts, unit dirs, units, path claims, tests, scrape/
dns/probe facts, aliases, stacks); scripts/service-map.py is its only
reader (hosts/services/allows/plan/seams/owner/units/stack/get/render/
check). deploy-plan.py becomes a thin CLI wrapper; both --service
allow-lists (deploy.sh, deploy-remote.sh) and the changed-test mapper are
the inventory. Selection semantics: host scoping (a host's tree selects
only its own services), the quadlet netns/network coupling graph resolved
across directories (gluetun's riders live in their own dirs), stacks, and
canonical restart order.

Against the pinned old-planner fixture: 921 raw deltas reduced to 17, all
intentional (anubis now maps; cross-host paths select nothing; the retired
qwen-sharp template plans nothing and the live froggeric template plans
frank-archon; dankserver/romm/romm.container, missed by the old filename
rule, plans the romm trio). The fixture is regenerated as the new pin.

Integrity gates: schema, unit claims, quadlet-file ownership, path-glob
liveness, Pi-hole hosts / Prometheus jobs / DNS / homepage probes drift.
tests/service_inventory.bats pins all of it plus the plan fixture and the
deploy-plan CLI. Allow-list grep seams in hermes_webui/observability_quadlet
become behavioral allows calls.

tests/observability_quadlet.bats

@@ -433,11 +433,14 @@ assert any('ALERTS' in e for e in exprs), exprs
     grep -q -- '--web.listen-address=127.0.0.1:9100' "$unit"
     grep -q -- '--web.listen-address=192.168.0.235:9100' "$unit"
     ! grep -qE -- '--web\.listen-address=(0\.0\.0\.0|:9100|\[::\])' "$unit"
-    # One owner per container name: the compose service must be gone, or two
-    # definitions fight over the same container.
-    ! grep -qE '^\s+node-exporter:' "$REPO_ROOT/dankserver/compose.yaml"
-    # The deploy path has to know about it on this target.
-    grep -q 'dankserver:node-exporter' "$REPO_ROOT/scripts/deploy-remote.sh"
+    # One owner per container name: Dankserver has no compose file at all
+    # since the 2026-10-13 retirement (it lived beside diverged quadlet
+    # mounts for weeks — the two-owners trap by construction).
+    [ ! -e "$REPO_ROOT/dankserver/compose.yaml" ]
+    # The deploy path has to know about it on this target — acceptance
+    # is the inventory (rank 3), not a literal list in the runner.
+    run python3 "$REPO_ROOT/scripts/service-map.py" allows --host dankserver --service node-exporter
+    [ "$status" -eq 0 ]
     run python3 "$REPO_ROOT/scripts/deploy-plan.py" --target dankserver \
         --paths dankserver/observability/quadlet/node-exporter.container
     [ "$status" -eq 0 ]