Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

tests/setup/skills-contract

@@ -257,14 +257,23 @@ fi
 
 # ── The stage runs, in the one order that gives personal skills precedence ──
 
+# Checked against every literal per-role stage list. The server list carries
+# no link-skills at all (its three skills operate the desktop), so the demand
+# is: at least one list runs it, and any list that runs it runs it between
+# link-dotfiles and link-user.
 python3 - "$installer" <<'PY' || note 'link-skills is not in STAGES between link-dotfiles and link-user'
 import re, sys
-line = next(l for l in open(sys.argv[1], encoding="utf-8") if l.startswith("STAGES="))
-stages = re.findall(r"[\w-]+", line)
-for name in ("link-dotfiles", "link-skills", "link-user"):
-    if name not in stages:
+lines = [l.strip() for l in open(sys.argv[1], encoding="utf-8")
+         if l.strip().startswith("STAGES=(") and "upgrade_stages" not in l]
+anywhere = False
+for line in lines:
+    stages = re.findall(r"[\w-]+", line)
+    if "link-skills" not in stages:
+        continue
+    anywhere = True
+    if not stages.index("link-dotfiles") < stages.index("link-skills") < stages.index("link-user"):
         raise SystemExit(1)
-if not stages.index("link-dotfiles") < stages.index("link-skills") < stages.index("link-user"):
+if not anywhere:
     raise SystemExit(1)
 PY