poweroff command behind --allow-poweroff, via polkit not sudo; deploy builds natively

The display can shut the Orin down: ack first, systemctl poweroff 2 s later.
Refused without --allow-poweroff (only the Orin's unit sets it), without
confirm, or with another boot's boot_id (hello now carries it), so a resend
after the reboot cannot shut the next boot down. polkit grants the service
user logind's power-off; no passwordless sudo involved at runtime.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

scripts/deploy.sh

@@ -1,29 +1,43 @@
 #!/usr/bin/env bash
-# Build svc-gw for aarch64, check it against the car's glibc, and install it
-# on an Orin as the yukart-gw service.
+# Build svc-gw natively on the development Orin, check it against the car's
+# glibc, and install it on an Orin as the yukart-gw service.
 #
 #   usage: scripts/deploy.sh [host]        (default: mikkeli-orin-nano)
+#   env:   BUILD_HOST                      (default: mikkeli-orin-nano-2)
 #
-# Cross-compiles from the workstation (the documented fallback): the development
-# Orin is the preferred native build host. Either way check-glibc.sh gates it.
+# Builds what is pushed, not the working tree: the build host pulls master of
+# svc-gw and contracts under ~/dev/yukart/. Native on purpose: the poweroff command
+# runs systemctl, and std::process::Command cross-compiled against the workstation's
+# newer glibc links GLIBC_2.39 symbols (pidfd_spawnp) the car cannot load.
 set -euo pipefail
 
 HOST="${1:-mikkeli-orin-nano}"
+BUILD_HOST="${BUILD_HOST:-mikkeli-orin-nano-2}"
 cd "$(dirname "$0")/.."
-TARGET=aarch64-unknown-linux-gnu
-BIN="target/$TARGET/release/svc-gw"
+BIN="$(mktemp -d)/svc-gw"
 
-cargo build --release --target "$TARGET"
+ssh "$BUILD_HOST" 'set -e
+  mkdir -p ~/dev/yukart && cd ~/dev/yukart
+  for r in svc-gw contracts; do
+    [ -d $r ] || git clone -q http://192.168.2.199:3005/yukart/$r.git
+    git -C $r pull -q --ff-only
+  done
+  cd svc-gw && ~/.cargo/bin/cargo build --release 2>&1 | tail -1
+  git log --oneline -1'
+scp -q "$BUILD_HOST:dev/yukart/svc-gw/target/release/svc-gw" "$BIN"
 scripts/check-glibc.sh "$BIN"
 
 # Binary lives under ~/infra per the host repo's guidelines; /usr/local/bin gets a symlink.
 ssh "$HOST" 'mkdir -p ~/infra/svc-gw'
 scp -q "$BIN" "$HOST:infra/svc-gw/svc-gw.new"
 scp -q deploy/yukart-gw.service "$HOST:infra/svc-gw/yukart-gw.service"
+scp -q deploy/50-yukart-gw-poweroff.pkla "$HOST:infra/svc-gw/50-yukart-gw-poweroff.pkla"
 ssh "$HOST" 'set -e
   mv ~/infra/svc-gw/svc-gw.new ~/infra/svc-gw/svc-gw
   sudo ln -sfn "$HOME/infra/svc-gw/svc-gw" /usr/local/bin/yukart-gw
   sudo install -m 0644 ~/infra/svc-gw/yukart-gw.service /etc/systemd/system/yukart-gw.service
+  # polkit, not sudo, lets the service power the host off (the poweroff command).
+  sudo install -m 0644 ~/infra/svc-gw/50-yukart-gw-poweroff.pkla /etc/polkit-1/localauthority/50-local.d/50-yukart-gw-poweroff.pkla
   sudo systemctl daemon-reload
   sudo systemctl enable yukart-gw.service >/dev/null
   sudo systemctl restart yukart-gw.service