M2: Drone server + exec runner up; infra as idempotent-reconcile oneshots

Convert proxy+drone bring-up to writeShellApplication systemd oneshots that
reconcile every activation (orchestrator steer). pkgs.abra overlay. Runner
connected via RPC (polling, capacity=2). install.md = clone + nixos-rebuild switch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -32,6 +32,22 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
   - **abra teardown syntax** (for harness, §4.3): `abra app undeploy <d> -n`,
     `abra app volume remove <d> -f -n`, `abra app secret remove <d> --all -n`. None take `--chaos`.
 
+- **Infra bring-up = idempotent-reconcile systemd oneshots — SETTLED (M2, orchestrator steer
+  2026-05-26).** Every piece of swarm infra that abra deploys (traefik `modules/proxy.nix`, Drone
+  `modules/drone.nix`, later comment-bridge + dashboard) is a `systemd.services.<x>` with
+  `Type=oneshot` + `RemainAfterExit`, `after`/`requires` swarm-init + docker, `wants`
+  network-online, `wantedBy` multi-user, embedding its script via **`pkgs.writeShellApplication`**
+  (self-contained in the store, not a `/root/cc-ci` path). The script **reconciles** (inspect →
+  converge → no-op if correct) on *every* activation/boot — **no run-once sentinel** — so it
+  self-heals drift (stack gone → redeploy; secret missing → re-insert). Fails visibly (failed unit)
+  on missing preconditions (e.g. cert absent). Result: a from-scratch install (D8) collapses to
+  `git clone` + `nixos-rebuild switch` + operator preconditions, no manual post-steps. The old
+  `scripts/deploy-*.sh` were folded into these modules and removed. `pkgs.abra` is provided via an
+  overlay (`modules/packages.nix`) so all modules share the one pinned build.
+  - *Cert rotation note:* the proxy reconcile inserts ssl_cert/ssl_key only if absent; rotating the
+    wildcard means bumping `SECRET_WILDCARD_*_VERSION` (operator) so the next reconcile re-inserts.
+    Documented in docs/secrets.md at M7.
+
 ## Open (defaults from §8, to confirm as reality lands)
 
 - **Deploy mechanism — SETTLED (M0):** `nixos-rebuild switch --flake /root/cc-ci#cc-ci` run *on