[deploy-plugin DPB-7] Extract deploy-baremetal (build pipeline, Servy/systemd, compat handlers)

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

One target baremetal with variants windows|linux (legacy config keys map in via the compat union). Receives the deno compile build pipeline and BaremetalCompatibilityCommands — legacy flat verbs keep their exact shipped semantics; only build → plan+emit, status, logs alias, pinned to this target. Public composition of the convention ports closes DEPLOY-BAREMETAL-PUBLIC-WIRING. Systemd live-probe suite cell. Anti-scope: no desktop packaging; the adapter-neutral compile emitter graduates to core later (DP-3 §2; SF-2/SF-9, KF-3/4).

Acceptance

• gate: state-transition tests — stop never uninstalls, start never registers
• gate: full declared op set advertised at runtime (composition root wires ports)
• gate: legacy help/exit-code goldens unchanged
• gate: systemd live probe green on the probe lane

Metadata

Dependencies: DPB-2, DPB-3
Delivery shape: adapter extraction + compat handlers