feat(orchestrator): MVP synthetic life-injection worker (SSH only)

Adds a new decnet orchestrate worker whose job is to keep the honeypot
ecosystem from looking suspiciously static — a frozen LAN with no
inter-host traffic and no filesystem aging is its own honeypot tell.

MVP scope:
- New OrchestratorEvent table + repo methods (purpose-built sibling
  to Log so synthetic events stay separable from attacker-driven ones).
- New orchestrator.{activity,file}.<decky_id> bus topics +
  system.orchestrator.health heartbeat.
- SSH-only driver. Traffic action runs python3 inside src container
  to TCP-connect dst:22 and read the SSH banner — real on-the-wire
  SSH-protocol traffic without shipping creds. File action drops or
  refreshes a small file via docker exec on the destination.
- Random scheduler (50/50 traffic/file when >=2 SSH-capable deckies
  are running). Diurnal shaping, role-aware pairing, and session-aware
  backoff are explicit non-goals for MVP.
- CLI registration, systemd unit (SupplementaryGroups=docker),
  worker-registry entry so the dashboard shows orchestrator health.
- 11 tests: scheduler policy, driver argv shape + injection-safety,
  end-to-end one-tick integration with FakeBus + SQLite.

decnet/web/db/repository.py

@@ -857,3 +857,24 @@ class BaseRepository(ABC):
         """Auto-disable a subscription after repeated failures. Sets
         ``enabled=False`` and stamps ``auto_disabled_at``."""
         raise NotImplementedError
+
+    # ---------------------------------------------------------- orchestrator
+
+    async def list_running_topology_deckies(self) -> list[dict[str, Any]]:
+        """Return every TopologyDecky row whose ``state == 'running'``.
+
+        The orchestrator picks pairs from this set to drive synthetic
+        inter-decky activity. Cross-topology by design: a multi-topology
+        host still has a single orchestrator instance.
+        """
+        raise NotImplementedError
+
+    async def record_orchestrator_event(self, data: dict[str, Any]) -> str:
+        """Insert one orchestrator-emitted event row, returning its uuid."""
+        raise NotImplementedError
+
+    async def list_orchestrator_events(
+        self, *, limit: int = 100, since_ts: Optional[Any] = None
+    ) -> list[dict[str, Any]]:
+        """Return recent orchestrator events newest-first."""
+        raise NotImplementedError