Build the guest on Saruman that stacks/lab/ runs in

[Gerrrt]

Split out of #101. Shape settled
by ADR-0019.

stacks/lab/ is a compose stack, and a compose stack is Docker. Saruman is
the one host in the estate that must not run Docker —
scripts/deploy-agent.sh
says why, and it is the reason #88 deployed the native .deb there rather than
a container: "a host that should not run Docker — Saruman is a Proxmox
hypervisor, whose own firewall ADR-0014 relies on and whose iptables Docker
would rewrite."

So the stack needs a guest, and the guest does not exist. This is the
prerequisite for the stack itself and nothing else in #101 blocks on it.

What it is

• A Linux guest on Saruman, single-homed on VLAN 30 — no trunk, no
  VLAN-aware bridge, per ADR-0007.
• A static below .100, with a reservation. 10.0.30.110 is the one fixed
  address in the estate that sits inside a DHCP pool
  (network.md),
  and that is a known defect rather than a pattern to copy. .20 and .30 are
  already spoken for — Saruman moves to 10.0.30.20 and ifrit takes
  10.0.30.30 as part of Procure ifrit and build the playground — after the main network is finished #96.
• Docker, and nothing else the hypervisor would otherwise be asked to carry.
• No pass to 10.0.99.20. Deploy Alloy to Saruman and oracle #88's rule is the hypervisor's alone; ADR-0007's
  "guests get no such rule" covers this guest too.

Undecided, and part of this issue

• The name. Not minted in the ADR on purpose.
• The address, in step with Saruman's move to .20.
• The distribution and how it is built — by hand, or from the same
  deploy-agent.sh-shaped "one command, converges" direction Move deployment from make up over SSH to something pull-based #99 wants.

Done when

• The guest exists, reachable from Hicks, and docs/network.md's
  ImaginationLAN table has its row — including the note that Saruman no
  longer "currently runs no guests".
• docs/architecture.md's host and stack mapping has its row. This is not
  optional and not for later: check_host_stack_table in
  scripts/check_docs.py
  fails on any directory under stacks/ that no row names, so the stack cannot
  land without it.