feat(engine): de-slop commons, harden security, add targeted compose and env bridge

- Purge misplaced RFCs, scratch tokens, and node-proprietary assets
- Decouple remote provisioning to ci/scripts/init-node.py
- Add targeted composition orchestration in actions/compose.py
- Add host-side Xray stale socket cleanup in /dev/shm
- Add actions/env.py for shell exports and .env synchronization
- Harden UFW, backup retention, host tempfiles, and notify dispatcher
- Add pyproject.toml and Makefile with 78 passing unit tests

tests/test_notify.py

@@ -11,7 +11,7 @@ class TestNotify(unittest.TestCase):
         self.assertIn("#instance_node1_example_com", t)   # dots -> underscores in the hashtag
 
     def test_html_escaped_and_truncated(self):
-        t = build_text("A & B", "<script>" + "x" * 300, "d", "ERROR", "T")
+        t = build_text("A & B", "<script>" + "x" * 4000, "d", "ERROR", "T")
         self.assertIn("A &amp; B", t)
         self.assertIn("&lt;script&gt;", t)
         self.assertIn("...", t)