gdo: the code that opens the iris

A durable consumer on portal's WORMHOLE stream, each message handed to
the host's SMTP as text with an HTML alternative; acked on acceptance,
retried after a minute otherwise, left for a newer gdo when the
contract version is unknown. `gdo probe <to>` sends one through and
waits for the consumer to drain. GDO_TYPST_THEME attaches a Typst PDF.
A systemd unit and an installer for one gdo per host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

deploy/gdo.service

@@ -0,0 +1,21 @@
+# One per host, not per site: every portal instance on the host
+# publishes to the same WORMHOLE stream, and each message carries its
+# own sender. Install with deploy/install.sh.
+[Unit]
+Description=gdo - delivers portal's outgoing mail to the host's SMTP
+After=network-online.target nats-server.service postfix.service
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/local/bin/gdo
+EnvironmentFile=-/etc/gdo.env
+DynamicUser=yes
+Restart=always
+RestartSec=5
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target