feat(deploy): Komodo fleet deployment — resources.toml + decision

Adopt Komodo Periphery (over the NetBird mesh) as the booth fleet control plane,
superseding SSH-and-booth.sh. The booth runs the SAME compose files; Komodo Core
drives them remotely. booth.sh is demoted to a break-glass local fallback.

- komodo/resources.toml mirrors the working park-buzi Stack (built by hand in the
  Core UI, then exported to TOML — field names match the running v2.2). Stack-only:
  servers are created by the agent onboarding OUTBOUND (one-time onboarding key →
  Periphery self-registers, auto-rotating keys, booth opens no inbound port), so
  there is no [[server]] block. Per-booth secrets via [[...]] refs to Core's store.
- komodo/README.md + .env.komodo.example document the flow and the hard rules
  (no webhook; onboarding/outbound/mesh-only; per-booth unique secrets; never
  down -v the ledger volume).
- wiki/decisions/fleet-deployment-komodo.md records the decision + threat-model
  analysis (Periphery is a root agent → mesh-bound; EVENT_SIGNING_KEY-in-Core is a
  fraud-root blast radius until ATECC608 signs; Core is now Tier-0; GPL-3.0 is fine
  as external ops tooling). container-deployment reframed (booth.sh = fallback);
  index + log updated.

Verified end-to-end against a real booth (park-buzi): onboarded OK, Stack deployed,
all containers green, admin seeded.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1672,3 +1672,31 @@ unprivileged for the non-root container user. Verified on hardware: the readers
 ICMP on the device VLAN (eth1) — distinct MACs — and the UI Test connection shows "● ready — ping
 10.0.10.7". (NB: an earlier "offline" reading was a WSL wrong-route artifact, not the readers.) Covered
 by `reader.test.ts` (4 tests). Documented in [[device-status-monitoring]]. Devices +4 tests, all green.
+
+## [2026-06-27] fix | booth.sh failed in the flat /opt layout (couldn't find compose files)
+
+The booth deploys the compose files **flat** in `/opt/parking_systems/` with `booth.sh` next to
+them, but the script assumed `<repo>/scripts/` and did `cd ..` → `REPO_DIR=/opt` (no compose
+files); `usage()` then `sed`-read a now-relative `$0` → "can't read booth.sh". That's why
+`sudo ./booth.sh` only printed help and `/bin/bash booth.sh` errored. Fix: **discover** the
+compose files (script's own dir → `../` → `$PWD`), `usage()` reads an absolute `$SELF`. Also:
+`.env.example` defaulted `TAG=main`, but the registry only has `dev`/`dev-<sha>` (no main build) →
+`compose pull` 404s; default to `TAG=dev` + documented the moving-vs-immutable tag scheme.
+Reproduced the booth's flat layout in a scratch dir; all forms (`./booth.sh`, `/bin/bash
+booth.sh`, `config`, absolute-path) verified. Commit 83298bc.
+
+## [2026-06-27] decision | Fleet deployment → Komodo Periphery over NetBird
+
+booth.sh hit its ceiling: fine for one SSH-able box, but no remote/no-SSH op, no fleet view, no
+deploy history, no rollback — and the fleet is **many/growing**. Decision: **Komodo Periphery**
+on each appliance, driven by an existing **Komodo Core** over the **NetBird** mesh, running the
+**same** compose files ([[container-deployment]] pipeline unchanged); `booth.sh` demoted to
+break-glass. Three settled choices: many/growing fleet · deploys **manual + pinned** to a
+`dev-<sha>` (no webhook — preserves the determinism we chose by pinning) · secrets
+**Komodo-managed, per-booth + unique**. Threat-model caveats recorded: Periphery is a root agent
+(bind to NetBird interface only, passkey+TLS, part of the TCB); `EVENT_SIGNING_KEY` in Core is a
+fraud-root blast radius → per-booth keys + [[atecc608-secure-element|ATECC608]] as the real
+long-term signer; Core becomes Tier-0. GPL-3.0 OK (external ops tooling, not a shipped dep — same
+boundary logic as the AGPL vision exception). New page [[fleet-deployment-komodo]]; infra-as-code
+sketch in `komodo/` (`resources.toml` + README + `.env.komodo.example`). Catalogued in `index.md`;
+`container-deployment` cross-linked + reframed (booth.sh = fallback).