[Deploy-S5] Bare-metal hardening (beta): rollback + health-gate + OTEL + secrets

[rickylabs]

Scope

Bare-metal hardening — beta slice (decision D3 v1 line): atomic rollback, health-gated activation, OTEL_DENO wiring, and restricted-permission env-file secrets on the deno compile + service-adapter lane. (Multi-instance/HA + external secret store + signing automation are the deferred stable slice, tracked separately.)

Target / adapter

Bare-metal (Linux systemd + Windows SERVY).

Acceptance criteria

• Atomic activate/rollback of the binary+unit (previous version retained; rollback verb works).
• Health-gated activation: new version only takes traffic after a health probe passes.
• OTEL_DENO env wired through the service unit.
• Secrets written to a restricted-permission env-file (0600-equivalent), never world-readable.
• Tests cover rollback + health-gate paths.

Dependencies

S3 (OsServicePort/adapters) + S4 (deno compile artifact). Phase 1.

Tier / phase

BETA · Phase 1 · milestone 0.0.1-beta.1

Parent epic: #327