poweroff command behind --allow-poweroff, via polkit not sudo; deploy builds natively

The display can shut the Orin down: ack first, systemctl poweroff 2 s later.
Refused without --allow-poweroff (only the Orin's unit sets it), without
confirm, or with another boot's boot_id (hello now carries it), so a resend
after the reboot cannot shut the next boot down. polkit grants the service
user logind's power-off; no passwordless sudo involved at runtime.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

deploy/50-yukart-gw-poweroff.pkla

@@ -0,0 +1,12 @@
+# polkit (0.105, local authority): lets the svc-gw user power the host off through
+# logind, with no sudo. svc-gw runs `systemctl poweroff` for the display's
+# `poweroff` command (contracts BOUNDARY.md). Nothing else is granted.
+# Installed to /etc/polkit-1/localauthority/50-local.d/ by scripts/deploy.sh.
+# multiple-sessions: an ssh login is another session; ignore-inhibit: no inhibitor lock
+# (none are taken on this host today) should leave the button silently doing nothing.
+[yukart-gw: power off]
+Identity=unix-user:mikkeli
+Action=org.freedesktop.login1.power-off;org.freedesktop.login1.power-off-multiple-sessions;org.freedesktop.login1.power-off-ignore-inhibit
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes

deploy/yukart-gw.service

@@ -8,7 +8,8 @@ StartLimitIntervalSec=0
 [Service]
 User=mikkeli
 # Add --mock only on a bench unit: every message then says so, and displays must show it.
-ExecStart=/usr/local/bin/yukart-gw --listen 0.0.0.0:7700
+# --allow-poweroff: the display may shut this host down (contracts BOUNDARY.md, poweroff). Only on the Orin.
+ExecStart=/usr/local/bin/yukart-gw --listen 0.0.0.0:7700 --allow-poweroff
 Restart=always
 RestartSec=2