Package owned nodes with Guix and a Stapeln/Wolfi container path

[hyperpolymath]

Outcome

Package and operate Bag nodes as repeatable owned infrastructure using the estate’s deployment conventions.

Scope

• Provide Guix service definitions for coordinator, worker, webhook receiver, and scheduled/manual sweep modes.
• Define Stapeln-compatible future container boundaries and build a nerdctl-runnable Chainguard Wolfi image where containers add value.
• Integrate the related Stapeln ecosystem projects for composition, policy, provenance, health, and service supervision as their current interfaces permit.
• Run as a non-root user with read-only root filesystem, bounded writable state, dropped capabilities, and explicit network policy.
• Document key provisioning/rotation, backup, restore, upgrade, rollback, and disaster recovery.
• Support both a persistent server and an intermittently connected developer workstation.

Acceptance criteria

• A fresh owned machine can be provisioned from repository-controlled declarations.
• Container and native Guix service paths run the same signed conformance sweep.
• Secrets are mounted/provisioned rather than baked into images or artefacts.
• Upgrade and rollback drills preserve ledger and verification integrity.