refact(deployer): the LLM handlers gate through the shared library

deploy_llm_dragoon/zealot/arkon now call require_image / require_bytes /
require_min_mib / require_file / require_dir_files, so the deployer and the
serve scripts refuse the same missing payload with the same words — the
2026-10-01 crash-loop law, enforced by construction instead of by duplicated
shell. require_exec joins the library for the native-runtime gate (a
compiled tree that lost its +x refuses like a missing one). relink_unit
takes SYSTEMD_SYSTEM_DIR so a handler can be driven end to end in a sandbox.

The library's own refusals now carry their status: a bash function that
ends inside an if returns the CONDITION's status, so a gate whose last
statement is its refusal printed the message and returned SUCCESS — the
new seam caught it, and the gate tests pin it.

New seam tests/llm_deploy_gates.bash + tests/stubs/: deploy-remote.sh's LLM
handlers EXECUTED against stub systemctl/podman/sudo/ss/curl, asserting
exit status, refusal text, no restart, and the pending state marker.

tests/stubs/curl

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+exit 0

tests/stubs/podman

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Stub podman for the deploy-handler seam: `image exists` succeeds only for
+# $STUB_IMAGE (empty = nothing in storage); every other verb is a no-op.
+# The invocations are logged so a test can read what the handler executed.
+printf '%s\n' "$*" >> "${STUB_PODMAN_LOG:-/dev/null}"
+case "$1 $2" in
+    "image exists")
+        [[ -n "${STUB_IMAGE:-}" && "$3" == "$STUB_IMAGE" ]] || exit 1
+        ;;
+esac
+exit 0

tests/stubs/sleep

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+exit 0

tests/stubs/ss

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+exit 0

tests/stubs/sudo

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Stub sudo for the deploy-handler seam: run_privileged pipes the password
+# on stdin and calls `sudo -S -- <cmd>`. The stub drops the password and the
+# flags and execs the command, so no privilege gate hides a handler bug.
+cat >/dev/null 2>&1 || true
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        -S|--prompt) shift ;;
+        --) shift; break ;;
+        *) break ;;
+    esac
+done
+exec "$@"

tests/stubs/systemctl

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Stub systemctl for the deploy-handler seam: every invocation is logged, so
+# a test asserts on what the handler ASKED systemd to do. `is-active` answers
+# "inactive" (the state a cutover finds the unit in) and MainPID answers
+# $STUB_MAIN_PID — 0 is the stray-port-holder shape, the false-green gate
+# every LLM handler reads after a health answer.
+printf '%s\n' "$*" >> "${STUB_SYSTEMCTL_LOG:-/dev/null}"
+case "$*" in
+    "is-active "*) echo inactive ;;
+    *"MainPID --value "*) echo "${STUB_MAIN_PID:-4242}" ;;
+esac
+exit 0