Fix station bootstrap and defaults; harden application monitoring readiness

[leveldorado]

A fresh station could fail before CA publication because Zig 0.16 opened the operation-lock directory with Linux O_PATH, which flock rejects even when the lock is free. Open a readable directory descriptor, preserve exclusive nonblocking locking, and distinguish OperationBusy from fixed filesystem/PKI diagnostics. Converge absent or empty ingress directories, recover proven unpublished candidates, reuse published CA/server identity, and restrict registry migration to the known 0700-to-0750 generation. Invalid active state still fails without rotation or private output.

Station install, verify, status and notify-test now load optional CWD ./station.toml. Explicit --config replaces the default, CLI values take precedence, and canonical [station].hostname supplies the independent mTLS identity. The v1 [ingress].hostname alias remains compatible unless contradictory. Plans show connection/hostname/ports without resolving secrets; application commands retain ./monitoring.toml.

The earlier application-hardening changes accept fresh failed-scrape telemetry when the app is down, preserve real-payload requirements for successful targets, improve safe application checks, and read TLS client-auth alerts before sending HTTP. The pinned Doers process fixture covers zero-client station readiness, scoped app publication/removal, trusted metrics/logs, quiet streams, alert hold/recovery, no-op publication and bounded outage buffering. Station/application ownership, service units, rule definitions, pins and public networking scope stay unchanged.

Validation at d8393b7:

• Zig 0.16.0: zig fmt --check build.zig src, zig build, zig build -Doptimize=ReleaseSafe, and zig build test --summary all passed locally; 398/398 Zig tests (including 45 native lifecycle/PKI tests).
• python3 tests/cli_smoke.py: 293 checks passed; unavailable Fish checks skipped. Vendor integrity, version/diagnostic and release packaging checks passed.
• Cross-compiled native lifecycle/PKI binary: 45/45 passed on isolated Ubuntu 24.04 arm64.
• Real native helper chroot fixture: 10/10 passed on both Ubuntu 24.04 and 26.04, including exact root/dt-ingest empty production state, hostname validation, no-op, lock contention, invalid CA preservation and metadata refusal. No external crypto executable is present in the fixture root.
• All six GitHub Actions jobs passed at d8393b7: https://github.com/BaptizedDragon/dragontools/actions/runs/35428036279. macOS: 398/398 Zig tests and 293 CLI checks. Linux: 397 passed with one optional shell test skipped, plus 276 CLI checks; absent Zsh/Fish checks were skipped. Both platforms passed pinned Caddy mTLS and release checks; all four ReleaseSafe cross-build/package jobs passed.
• Linux CI also passed the entire Doers signal/alert/outage fixture, native helper install lifecycle, and all 10 exact-ownership bootstrap process tests. It observed real alert firing/resolution, scoped no-op publication, bounded Vector backpressure, and resumed delivery without an agent restart.

Disposable-host integration not run. No production SSH, service stop, DNS/firewall change or notification was performed. Filesystem/chroot, fake-remote and isolated process tests do not prove real systemd/journald, public listener reachability, two-host deployment or Telegram delivery. Deployment validation remains with the operator.