M2: Drone server + exec runner up; infra as idempotent-reconcile oneshots

Convert proxy+drone bring-up to writeShellApplication systemd oneshots that
reconcile every activation (orchestrator steer). pkgs.abra overlay. Runner
connected via RPC (polling, capacity=2). install.md = clone + nixos-rebuild switch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/abra.nix

@@ -1,25 +1,6 @@
-# abra — the Co-op Cloud CLI used by the harness to deploy/upgrade/backup recipes (M1+).
-# Packaged from the upstream release binary, pinned by version + hash for reproducibility (D8).
+# abra — the Co-op Cloud CLI used by the harness and the proxy/drone reconcile oneshots.
+# The package is defined as an overlay in modules/packages.nix (pkgs.abra), pinned by hash (D8).
 { pkgs, ... }:
-let
-  abra = pkgs.stdenv.mkDerivation rec {
-    pname = "abra";
-    version = "0.13.0-beta";
-    src = pkgs.fetchurl {
-      url = "https://git.coopcloud.tech/toolshed/abra/releases/download/${version}/abra_${version}_linux_amd64.tar.gz";
-      sha256 = "12csk6wp1pk9cspzqfl4a6h5jdz8p055sf0ggxw9k7ljhpd5qvc6";
-    };
-    # Tarball has files at the root (LICENSE, README.md, abra), no common subdir.
-    sourceRoot = ".";
-    nativeBuildInputs = [ pkgs.autoPatchelfHook ];
-    buildInputs = [ pkgs.stdenv.cc.cc.lib ];
-    installPhase = ''
-      runHook preInstall
-      install -Dm755 abra "$out/bin/abra"
-      runHook postInstall
-    '';
-  };
-in
 {
-  environment.systemPackages = [ abra ];
+  environment.systemPackages = [ pkgs.abra ];
 }