refact(deployer): the LLM handlers gate through the shared library

deploy_llm_dragoon/zealot/arkon now call require_image / require_bytes /
require_min_mib / require_file / require_dir_files, so the deployer and the
serve scripts refuse the same missing payload with the same words — the
2026-10-01 crash-loop law, enforced by construction instead of by duplicated
shell. require_exec joins the library for the native-runtime gate (a
compiled tree that lost its +x refuses like a missing one). relink_unit
takes SYSTEMD_SYSTEM_DIR so a handler can be driven end to end in a sandbox.

The library's own refusals now carry their status: a bash function that
ends inside an if returns the CONDITION's status, so a gate whose last
statement is its refusal printed the message and returned SUCCESS — the
new seam caught it, and the gate tests pin it.

New seam tests/llm_deploy_gates.bash + tests/stubs/: deploy-remote.sh's LLM
handlers EXECUTED against stub systemctl/podman/sudo/ss/curl, asserting
exit status, refusal text, no restart, and the pending state marker.

scripts/lib/llm-gates.sh

@@ -8,6 +8,7 @@
 # Both sides source this library, so the refusal is one text and one rule.
 #
 # Contract (public interface):
+#   require_exec      PATH LABEL HINT
 #   require_file      PATH LABEL HINT
 #   require_bytes     PATH LABEL WANT_BYTES HINT
 #   require_min_mib   PATH LABEL MIN_MIB HINT
@@ -20,7 +21,12 @@
 # scripts run under `set -e` (so a refusal is terminal), while the deployer
 # wants `|| return 1` so a failed gate reports a red deploy for that one
 # service and the dispatcher's state marker stays pending.
-#
+# Lines are labelled by ARTIFACT CLASS, and the class is the whole label
+# (the path rides in the same line): the class + path is what an operator
+# acts on, so no wording order and no payload rename can make the two twins
+# disagree. The deployer's old "halogen vision tower" and the serve script's
+# "vision-tower" were one gate in two vocabularies that no grep could join.
+
 # The size law is equality, not a floor, for `require_bytes`: a hub fetch
 # that truncates is the fleet's standing hazard (curl exits 0 on 401/403 and
 # writes the error body as the artifact), and the declared byte count is a
@@ -29,6 +35,14 @@
 # GATE_PREFIX names the endpoint in every refusal (e.g. frank-dragoon).
 : "${GATE_PREFIX:=gate}"
 
+# Two bash laws make the `return 1` at every call site load-bearing:
+#   * a function whose body ends inside an `if` returns the CONDITION's
+#     status (true = 0), so a gate that ends on its own refusal prints the
+#     refusal and reports SUCCESS;
+#   * `set -e` is suspended for any command in a `… || …` chain, so a gate
+#     that runs inside one must not be trusted to abort the caller.
+# Every gate's refusal therefore carries an explicit `|| return 1`, and the
+# caller consumes the status (`|| exit 1`, `|| return 1`).
 _gate_fail() {
     printf '%s: %s\n' "$GATE_PREFIX" "$1" >&2
     printf '  hint: %s\n' "$2" >&2
@@ -41,8 +55,21 @@ _gate_fail() {
 require_file() {
     local path="$1" label="$2" hint="$3"
     if [[ -L "$path" || ! -f "$path" ]]; then
-        _gate_fail "$label: missing at $path" "$hint"
+        _gate_fail "$label: missing at $path" "$hint" || return 1
     fi
+    return 0
+}
+
+# require_exec — PATH must be an executable regular file. The native runtimes
+# (llama.cpp's llama-server) are binaries the operator builds; a tree that
+# compiled but lost its +x, or a directory wearing the binary's name, must
+# refuse the same way a missing one does.
+require_exec() {
+    local path="$1" label="$2" hint="$3"
+    if [[ -L "$path" || ! -x "$path" ]]; then
+        _gate_fail "$label: missing at $path" "$hint" || return 1
+    fi
+    return 0
 }
 
 # require_bytes — PATH must exist AND be exactly WANT_BYTES bytes.
@@ -51,8 +78,9 @@ require_bytes() {
     require_file "$path" "$label" "$hint" || return 1
     got="$(stat -c %s "$path")"
     if [[ "$got" != "$want" ]]; then
-        _gate_fail "$label: is $got bytes, expected $want" "$hint"
+        _gate_fail "$label: is $got bytes, expected $want" "$hint" || return 1
     fi
+    return 0
 }
 
 # require_min_mib — PATH must be at least MIN_MIB mebibytes. The floor form
@@ -63,8 +91,9 @@ require_min_mib() {
     require_file "$path" "$label" "$hint" || return 1
     mib=$(( $(stat -c %s "$path") / 1048576 ))
     if (( mib < min )); then
-        _gate_fail "$label: is $mib MiB, expected >= $min MiB" "$hint"
+        _gate_fail "$label: is $mib MiB, expected >= $min MiB" "$hint" || return 1
     fi
+    return 0
 }
 
 # require_dir_files — DIR must be a directory and every named member a
@@ -77,13 +106,14 @@ require_dir_files() {
     shift 3
     local f
     if [[ -L "$dir" || ! -d "$dir" ]]; then
-        _gate_fail "$label: missing at $dir" "$hint"
+        _gate_fail "$label: missing at $dir" "$hint" || return 1
     fi
     for f in "$@"; do
         if [[ -L "$dir/$f" || ! -f "$dir/$f" ]]; then
-            _gate_fail "$label: $dir/$f is missing or a symlink" "$hint"
+            _gate_fail "$label: $dir/$f is missing or a symlink" "$hint" || return 1
         fi
     done
+    return 0
 }
 
 # require_image — the image ref must be in podman storage. A name@sha256 ref
@@ -92,6 +122,7 @@ require_dir_files() {
 require_image() {
     local ref="$1" hint="$2"
     if ! podman image exists "$ref"; then
-        _gate_fail "image: $ref is not in podman storage" "$hint"
+        _gate_fail "image: $ref is not in podman storage" "$hint" || return 1
     fi
+    return 0
 }