carlos / platform Public

Region HA plan 1a: the foundations for running instances on any box in a region

Spec 1 (box placement, rulings H1-H9) and plan 1a, built task by task with a
review after each, a whole-branch review and one fix wave. Everything here is
dormant on today's one-box regions: nothing changes which box runs an instance
and nothing starts the file publisher.

- internal/boxid: a box's AWS-signed identity record, verification, operator
  bind for legacy labels, embedded regional certificates.
- edges file: box_id (the box's label), the region-ha-1 capability, draining,
  and headroom (only with CARLOS_REGION_HA on).
- internal/edge: two boxes claiming one host are settled by installation stamp;
  equal stamps are reported. Unstamped routing is unchanged.
- internal/console: eligible boxes, one at a time, and a choice that spreads an app.
- internal/hostfiles: ordered manifest (immutable objects, one CAS manifest),
  restore that cannot escape its directory and is durable, descriptor-based
  directory sync, the continuous publisher and inotify watcher, wake state.
- internal/registry: ReplaceTimers. internal/termfence: termination evidence.
  internal/activator: the installation-complete marker and WarmCopyTrusted.
- infra: a termination queue per box, box records storage will not let anyone
  rewrite, root volumes deleted on termination. Not applied.

Open: the real-inotify tests and the IMDS signature check need the dev box;
check for an existing deployment-bucket policy before applying that module.
Plan 1b waits for the host lifecycle claim (#223).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Squashed from design-region-ha into main.