poweroff command behind --allow-poweroff, via polkit not sudo; deploy builds natively

The display can shut the Orin down: ack first, systemctl poweroff 2 s later.
Refused without --allow-poweroff (only the Orin's unit sets it), without
confirm, or with another boot's boot_id (hello now carries it), so a resend
after the reboot cannot shut the next boot down. polkit grants the service
user logind's power-off; no passwordless sudo involved at runtime.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

deploy/yukart-gw.service

@@ -8,7 +8,8 @@ StartLimitIntervalSec=0
 [Service]
 User=mikkeli
 # Add --mock only on a bench unit: every message then says so, and displays must show it.
-ExecStart=/usr/local/bin/yukart-gw --listen 0.0.0.0:7700
+# --allow-poweroff: the display may shut this host down (contracts BOUNDARY.md, poweroff). Only on the Orin.
+ExecStart=/usr/local/bin/yukart-gw --listen 0.0.0.0:7700 --allow-poweroff
 Restart=always
 RestartSec=2