feat(device-plane): add fail-closed deploy foundation

infra/deploy-runner/README.md

@@ -30,6 +30,7 @@ Supported components in this source:
 - `bim-viewer`
 - `n8n-private-extension`
 - `module-foundry`
+- `device-plane`
 - `proxy-contur`
 - `dc-amd-proxy`
 
@@ -429,3 +430,57 @@ Normal service deploys must still use explicit artifacts:
 sudo /usr/local/sbin/nodedc-deploy plan /volume1/docker/nodedc-deploy/inbox/<artifact>.tgz
 sudo /usr/local/sbin/nodedc-deploy apply /volume1/docker/nodedc-deploy/inbox/<artifact>.tgz
 ```
+
+## Device Plane foundation
+
+`device-plane` is an additive component rooted at:
+
+```text
+/volume1/docker/nodedc-device-plane
+```
+
+Its fixed Compose project is `nodedc-device-plane`. Ordinary application
+artifacts may select only `device-control-core` and `device-gateway`, always
+with `--no-deps`. `device-postgres` and the named
+`nodedc-device-plane-postgres-data` volume are durable prerequisites and are
+never selected or recreated by an application overlay.
+
+The sole exception is the exact one-time bootstrap artifact containing only
+the reviewed Compose file and
+`deployment/device-postgres-bootstrap-v1.json`. Its preflight requires both the
+Compose database container and named volume to be absent. It selects only
+`device-postgres`; a failed activation may remove that candidate container but
+never the volume. Any pre-existing container or volume is an ambiguity and
+fails closed.
+
+The runner creates or validates three root-owned secret files outside the
+artifact: the PostgreSQL password, Gateway-to-Core token and restricted
+identifier pepper. The manifest cannot choose their paths or values.
+
+The foundation publishes only loopback health endpoints on `18120` and
+`18121`. Raw device ingress `9921`, discovery ingest and outbound command
+transport remain disabled. The first application artifact must not be built or
+staged until this runner candidate is separately reviewed, promoted and proven
+by a fresh `verify-install`.
+
+Build and test the deterministic data-only artifact contract locally:
+
+```bash
+python3 -m unittest -v \
+  infra.deploy-runner.test_device_plane_registry \
+  infra.deploy-runner.test_device_plane_artifact
+
+node infra/deploy-runner/build-device-plane-artifact.mjs \
+  device-plane-foundation-YYYYMMDD-NNN
+```
+
+Any failed first activation removes only candidate Core/Gateway containers,
+never volumes, restores the source overlay and retains PostgreSQL state.
+
+After the runner is promoted and freshly verified, bootstrap the durable
+prerequisite with a separate artifact before planning the application:
+
+```bash
+node infra/deploy-runner/build-device-plane-postgres-bootstrap-artifact.mjs \
+  device-plane-postgres-bootstrap-YYYYMMDD-NNN
+```