Add a controlled customer-run homelab

[ebeirne]

What changed

• add a versioned, bounded homelab-sample/v1 contract with a checked-in synthetic fixture
• add a plug-and-play integration catalog and a versioned homelab-dataset/v1 NDJSON contract
• preflight an entire dataset before any write, then stream it through a bounded worker queue without loading the file into memory
• derive deterministic per-record idempotency keys and produce a sanitized capacity receipt with exact counts, observed rate, and p50/p95/p99 latency
• add laptop, workstation, and dedicated safety envelopes; these are input ceilings, not advertised throughput
• permit generated synthetic fixtures and ignored *.local.ndjson partner fixtures while keeping mounted inputs read-only
• accept already-deidentified local samples only after explicit acknowledgement and strict size, path, schema, and sensitive-data checks
• generate a fresh 32-byte Ed25519 evidence-signing key for new labs and atomically upgrade existing local .env files without printing or replacing existing values
• require the verifier to reject unsigned, malformed, tampered, or wrong-key Evidence Packs and verify the signature offline without receiving the private key
• bind the trace, sample hash, exact evidence sources, replay manifest, content hashes, signer key ID, and public-key fingerprint into the receipt
• update the pinned proof stack to Grafana 12.4.6, Prometheus 3.13.2, Tempo 2.10.3, Loki 3.7.4, and Alloy 1.18.0
• update the Grafana plugin toolchain, pin CI actions to immutable SHAs, and exclude generated/runtime data from Docker contexts

Why

Prospective customers need a reproducible way to validate a declared Lians integration and representative data shape before a pilot, without uploading production data or treating browser-only preflight as execution proof. The default stays laptop-sized; larger local intake is measured rather than claimed.

Scope

The homelab remains disposable and loopback-only. A passing receipt proves only the exact declared scenario, file, host, build, and safety envelope. It is not a general compatibility, production-capacity, security, compliance, or vendor-endorsement claim.

Per-record writes are deliberate because they preserve deterministic idempotency. Higher-throughput batch transport needs an explicit dataset-level idempotency contract first. API replicas likewise require a shared metrics strategy.

This PR is intentionally stacked on security/hardening-20260730, because the homelab depends on that runtime hardening. It does not modify the security PR branch.

Validation

• 39 homelab contract tests passed
• clean-revision dataset proof on bf0419e: 3/3 records succeeded, 0 failed, sanitized receipt emitted
• 1,000-record laptop reference run: 1,000/1,000 succeeded, 0 failed, 4.21 records/s, p95 1.74 s; recorded as a bottleneck measurement, not a capacity promise
• signed end-to-end proof passed on bf0419e with Ed25519 signature_valid: true, replayable evidence grade, and exact trace/source binding
• Grafana, Lians, Loki, Prometheus, and Tempo verification passed; all required services are running
• Python Ruff, PowerShell parser, Git shell syntax, Docker Compose rendering, staged-diff, receipt, and data-boundary checks passed
• Grafana plugin TypeScript typecheck and production build passed; emitted module externalizes Grafana/React host dependencies

[ebeirne]

Remote validation is green at head 2dacb69: both the homelab contract and containerized end-to-end proof passed. Run: https://github.com/Lians-ai/Lians/actions/runs/30692036223