[deploy][M0] Foundations + detection-only (shadow)

[vxfemboy]

Milestone tracker. Deploy blackwalld on sockpuppet as an Incus container, one iBGP session to BIRD, sFlow from the POPs, detecting but not acting (shadow). Gate to exit: N days of shadow logs match reality.

Features:

• [A·M1] Core foundation #1 POP sensor / sFlow shipper (DONE — telemetry ingest, PR feat(flow): anycast telemetry ingest — POP identity, tagging, liveness, sampling sanity #165)
• [A·M2] Deception engine #2 Anycast-aware aggregation (DONE — PR feat(flow): anycast telemetry ingest — POP identity, tagging, liveness, sampling sanity #165)
• [A·M2.1 follow-up] Buffer-accumulating parse for Redis/SMTP emulators #23 One-command bootstrap
• [C] ISP/BGP control plane #6 Incus container + source-IPs
• [D] Detection & telemetry #7 purrmetheus dashboard + alerts
• [A·M3] Discovery, shaping & flux #3 BIRD iBGP-snippet generator
• [A·M2] DeceptionTransport trait + NFQUEUE stateless transport #9 Network-wide shadow mode

Long pole was #1+#2 (done). Critical path: #23 → #6 → (#3 ∥ done-telemetry) → #9 → deploy detection-only.

[vxfemboy]

#9 shadow mode — DONE (PR #187, merged). Global shadow config directive: RTBH/FlowSpec/XDP mitigations are logged + metered (blackwall_shadow_would_mitigate_total{plane,action}) + audit-logged (/v1/audit), never executed; persistent mirror stays empty so a shadow→live restart can't promote never-vetted entries. Non-breaking.

M0 remaining: #3 BIRD-gen (#172), #6 Incus (#175), #7 purrmetheus (#176), #23 bootstrap (#185).

[vxfemboy]

#23 bootstrap + #6 Incus container — artifacts authored (deploy repo branch blackwall-m0, off auth-nameservers). Blackwalld flow packaged as an incusbr0-only Incus container running shadow/detection-only: build.sh (bootstrap — postgres DB/role, container, binary+systemd unit, DB env; pg-backups auto-covers the DB), install-in-container.sh, blackwall.conf.tmpl (ships shadow), a host blackwall-sflow-forward.sh DNAT, and docs/BLACKWALL.md runbook. iBGP over incusbr0 via the shipped blackwalld bird-config. Not merged/applied — operator review + apply. Remaining M0: #7 purrmetheus (#176).

[vxfemboy]

M0 artifacts COMPLETE. All M0 pieces exist: blackwall code (telemetry #1/#2, shadow #9, BIRD-gen #3, all merged) + deploy glue (#23 bootstrap + #6 container + #7 purrmetheus, authored on deploy branch blackwall-m0). The detection-only shadow deploy is fully buildable. Remaining M0 = operator apply (run build.sh on sockpuppet, fill config, wire BIRD/sFlow/monitoring — see docs/BLACKWALL.md) + a shadow observation period. Then M1 (arm with safety).