[T-Crypt]

Third slice of v0.5: per-card gateway endpoints.

What changes for users

On a node with several cards, berth cordon gpu1 closes a card to new work while the other cards keep serving: for maintenance, a driver test, or before a VM takes the card. berth uncordon gpu1 reopens it. The card can be named by its name or its PCI address.

• What holds the card keeps running. A cordon drains nothing, and berth stop ENGINE does that.
• New leases wait, and their reason says the card is cordoned. A hold (berth hold, a game claim) is still granted.
• berth status marks the card CORDONED, and berth events records card.cordoned and card.uncordoned.
• The gateway treats the card as out of reach. A plain /v1 request goes to another card that serves its model (feat(gateway): place a plain request on the cheapest card #280's ranking), no background engine starts for the card, and a ComfyUI job for it queues.
• The cordon lives in berthd's memory, so a berthd restart clears it. The docs and the command's help say so.

How

• Broker: a cordoned flag. evaluate returns early for any waiter below Hold, Cordon(on) emits the event and schedules at once, and Status sets GPU.Cordoned.
• Protocol: OpCordon and OpUncordon with Card, answered with the cards' names in Cards. node.Cordon uses Pick, so a comma list or a PCI address works as it does for berth run --gpu.
• CLI: berth cordon and berth uncordon, modelled on berth stop, with JSON and YAML output.
• Gateway: cardFree and outOfReach check a cordoned card. reach (from feat(gateway): place a plain request on the cheapest card #280) builds on both, so a cordoned card ranks last.

The branch merges next after #280. That merge commit also resolves the roadmap conflict, adds a "gpu0 cordoned" case to the #280 placement test, and adds the cordon to the gateway page's placement list.

Proof

• TestCordonStopsNewGrantsUntilUncordoned (broker): a foreground waiter is kept with a reason naming the cordon, a hold is granted, and the waiter is granted after the uncordon. Status shows the flag both ways.
• TestCordonAgainstADaemon (CLI): cordon and uncordon through the socket, CORDONED in berth status, the JSON flag, and exit 1 for an unknown card.
• TestCordonedCardIsNotFree (gateway): outOfReach names the cordon on gpu1 and nothing on gpu0, and no background run is queued for gpu1 until the uncordon. With the two gateway changes reverted, both assertions fail.
• The placement test's "gpu0 cordoned" case goes to gpu1.
• Build, gofmt, vet, go test ./..., the Windows build and vet, and golangci-lint (0 issues) all pass on the merged branch.