Boundary v0: WebSocket with heartbeats, acked commands and mock state

One socket on :7700 carries hello, heartbeats both ways (5 s timeout), 5 Hz
state snapshots of envelopes, and idempotent commands. 'mark' is forwarded to
the recorder's control socket. --mock synthesises degrading state flagged as
mock in every envelope; without it a client gets hello and heartbeats only.
Peers outside loopback, RFC 1918 and the tailnet are refused. Deployed on the
car Orin as yukart-gw.service.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

README.md

@@ -15,5 +15,12 @@ HTTP API so a display has one address to talk to.
 
 It is a bus subscriber. It never touches hardware and never transmits on CAN.
 
+```bash
+cargo run -- --mock                 # on a workstation: mock state, flagged as mock
+scripts/deploy.sh                   # build, glibc check, install yukart-gw on the car Orin
+```
+
+Needs [contracts](gitea:yukart/contracts) checked out beside this repo.
+
 - For implementation practice guidelines, refer to the [guidelines](docs/GUIDELINES.md);  
 - For implementation plans and history, refer to [them](docs/impl/);