Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/Agentchat/compose.yml

@@ -0,0 +1,27 @@
+networks:
+  nginx-bridge:
+    external: true            # ALWAYS external; see AGENTS.md §5
+
+services:
+  agentchat:
+    image: git.gbrown.org/gib/agentchat:latest
+    container_name: agentchat
+    hostname: agentchat
+    domainname: agentchat.gbrown.org
+    networks: ['nginx-bridge']
+    ports:
+      # Loopback only: lets this host's own agent reach the hub at
+      # http://127.0.0.1:8080 without going through NPM - the LAN access
+      # list there blocks the VPS's public IP. Unreachable from elsewhere.
+      - '127.0.0.1:8080:8080'
+    environment:
+      - TZ=America/New_York
+      - AGENTCHAT_DB=/data/agentchat.db
+    volumes:
+      - ./data:/data:z        # lowercase :z — watchtower recreates DROP the relabel flag, and :Z-category files would lock the new container out (learned 2026-08-13); :z keeps them accessible
+    labels: ['com.centurylinklabs.watchtower.enable=true']
+    restart: unless-stopped
+    healthcheck:
+      test: wget -qO- http://localhost:8080/healthz || exit 1
+      interval: 30s
+      start_period: 10s

server/containers/Agentchat/podman-agentchat.service

@@ -0,0 +1,24 @@
+# TEMPLATE for a rootless user unit.
+# Install to ~/.config/systemd/user/podman-<name>.service then:
+#   systemctl --user daemon-reload && systemctl --user enable --now podman-<name>.service
+# Requires linger:  sudo loginctl enable-linger $USER
+[Unit]
+Description=Podman Compose: agentchat
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/Agentchat
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=300
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target