feat(orchestrator): MVP synthetic life-injection worker (SSH only)

Adds a new decnet orchestrate worker whose job is to keep the honeypot
ecosystem from looking suspiciously static — a frozen LAN with no
inter-host traffic and no filesystem aging is its own honeypot tell.

MVP scope:
- New OrchestratorEvent table + repo methods (purpose-built sibling
  to Log so synthetic events stay separable from attacker-driven ones).
- New orchestrator.{activity,file}.<decky_id> bus topics +
  system.orchestrator.health heartbeat.
- SSH-only driver. Traffic action runs python3 inside src container
  to TCP-connect dst:22 and read the SSH banner — real on-the-wire
  SSH-protocol traffic without shipping creds. File action drops or
  refreshes a small file via docker exec on the destination.
- Random scheduler (50/50 traffic/file when >=2 SSH-capable deckies
  are running). Diurnal shaping, role-aware pairing, and session-aware
  backoff are explicit non-goals for MVP.
- CLI registration, systemd unit (SupplementaryGroups=docker),
  worker-registry entry so the dashboard shows orchestrator health.
- 11 tests: scheduler policy, driver argv shape + injection-safety,
  end-to-end one-tick integration with FakeBus + SQLite.

decnet/cli/__init__.py

@@ -30,6 +30,7 @@ from . import (
     inventory,
     lifecycle,
     listener,
+    orchestrator,
     profiler,
     sniffer,
     swarm,
@@ -54,7 +55,7 @@ for _mod in (
     api, swarmctl, agent, updater, listener, forwarder,
     swarm,
     deploy, lifecycle, workers, inventory,
-    web, profiler, sniffer, db,
+    web, profiler, orchestrator, sniffer, db,
     topology, bus, geoip, init, webhook,
 ):
     _mod.register(app)

decnet/cli/orchestrator.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+import typer
+
+from . import utils as _utils
+from .utils import console, log
+
+
+def register(app: typer.Typer) -> None:
+    @app.command(name="orchestrate")
+    def orchestrate_cmd(
+        interval: int = typer.Option(
+            60, "--interval", "-i",
+            help="Seconds between synthetic activity ticks",
+        ),
+        daemon: bool = typer.Option(
+            False, "--daemon", "-d",
+            help="Detach to background as a daemon process",
+        ),
+    ) -> None:
+        """Inject synthetic life (inter-decky traffic + file ops) into the fleet."""
+        import asyncio
+        from decnet.orchestrator import orchestrator_worker
+        from decnet.web.dependencies import repo
+
+        if daemon:
+            log.info("orchestrator daemonizing interval=%d", interval)
+            _utils._daemonize()
+
+        log.info("orchestrator starting interval=%d", interval)
+        console.print(
+            f"[bold cyan]Orchestrator starting[/] (interval: {interval}s)"
+        )
+
+        async def _run() -> None:
+            await repo.initialize()
+            await orchestrator_worker(repo, interval=interval)
+
+        try:
+            asyncio.run(_run())
+        except KeyboardInterrupt:
+            console.print("\n[yellow]Orchestrator stopped.[/]")