Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/containers/ISponsorBlockTV/compose.yml

@@ -0,0 +1,30 @@
+# iSponsorBlockTV — VPS (ROOTLESS PODMAN) port of the home server's
+# ~/Server/isponsorblocktv, migrated 2026-08-12.
+#
+# Why this works off-LAN: the configured device is pinned by `screen_id`, which uses
+# YouTube's CLOUD lounge API rather than a direct LAN connection to the Apple TV. So it
+# does not need to be on the same network as the TV. (If you ever re-pair a device via
+# SSDP/mDNS discovery, that step DOES need LAN access and must be done from home.)
+#
+# Rootless adaptations:
+#   - `user: 1000:1000` REPLACED with userns_mode keep-id. Under a rootless userns the
+#     original would resolve to subuid 525287 and lose access to its own gib-owned data
+#     directory -- the exact failure that kept n8n broken for two months. See AGENTS.md §3.2.
+#   - :Z on the data mount (SELinux Enforcing).
+#   - network_mode: host retained to match home. It works fine rootless.
+
+services:
+  isponsorblocktv:
+    image: ghcr.io/dmunozv04/isponsorblocktv:latest
+    container_name: iSponsorBlockTV
+    network_mode: host
+    userns_mode: "keep-id:uid=1000,gid=1000"
+    environment:
+      - TZ=America/New_York
+    volumes:
+      - './volumes/isponsorblocktv:/app/data:Z'
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+    tty: true
+    stdin_open: true
+    restart: unless-stopped

server/containers/ISponsorBlockTV/podman-isponsorblocktv.service

@@ -0,0 +1,21 @@
+[Unit]
+RequiresMountsFor=/home/gib/Media
+Description=Podman Compose: iSponsorBlockTV
+After=network-online.target podman.socket
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/Server/ISponsorBlockTV
+ExecStart=/usr/bin/podman compose up -d
+ExecStop=/usr/bin/podman compose down
+RemainAfterExit=yes
+TimeoutStartSec=600
+TimeoutStopSec=60
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target