feat(engine): de-slop commons, harden security, add targeted compose and env bridge

- Purge misplaced RFCs, scratch tokens, and node-proprietary assets
- Decouple remote provisioning to ci/scripts/init-node.py
- Add targeted composition orchestration in actions/compose.py
- Add host-side Xray stale socket cleanup in /dev/shm
- Add actions/env.py for shell exports and .env synchronization
- Harden UFW, backup retention, host tempfiles, and notify dispatcher
- Add pyproject.toml and Makefile with 78 passing unit tests

actions/sync/repository.py

@@ -39,7 +39,7 @@ def run(ctx, args):
         else:
             git("checkout", "-b", branch)
         git("add", "-A")
-        git("submodule", "update", "--remote", "--recursive")
+        git("submodule", "update", "--init", "--recursive")
         git("add", "commons")
         if git("diff", "--cached", "--quiet", check=False).returncode != 0:
             git("commit", "-m", f"[{node}] Auto-commit: {ts}")