feat(engine): de-slop commons, harden security, add targeted compose and env bridge

- Purge misplaced RFCs, scratch tokens, and node-proprietary assets
- Decouple remote provisioning to ci/scripts/init-node.py
- Add targeted composition orchestration in actions/compose.py
- Add host-side Xray stale socket cleanup in /dev/shm
- Add actions/env.py for shell exports and .env synchronization
- Harden UFW, backup retention, host tempfiles, and notify dispatcher
- Add pyproject.toml and Makefile with 78 passing unit tests

actions/backup/run.py

@@ -63,7 +63,8 @@ def run(ctx, args):
                              "backup produced no new snapshot (no restic.* labels discovered?)")
             raise SystemExit(1)
         log.info("Applying retention (forget --prune)...")
-        if restic("forget", "--prune", "--keep-daily", "7", "--keep-weekly", "4",
+        if restic("forget", "--prune", "--host", host, "--tag", tag,
+                  "--keep-daily", "7", "--keep-weekly", "4",
                   "--keep-monthly", "12", check=False).returncode != 0:
             ctx.notify.error(TITLE, url, "restic forget/prune failed"); raise SystemExit(1)
         log.success("Restic backup completed.")