feat(orchestrator): MVP synthetic life-injection worker (SSH only)

Adds a new decnet orchestrate worker whose job is to keep the honeypot
ecosystem from looking suspiciously static — a frozen LAN with no
inter-host traffic and no filesystem aging is its own honeypot tell.

MVP scope:
- New OrchestratorEvent table + repo methods (purpose-built sibling
  to Log so synthetic events stay separable from attacker-driven ones).
- New orchestrator.{activity,file}.<decky_id> bus topics +
  system.orchestrator.health heartbeat.
- SSH-only driver. Traffic action runs python3 inside src container
  to TCP-connect dst:22 and read the SSH banner — real on-the-wire
  SSH-protocol traffic without shipping creds. File action drops or
  refreshes a small file via docker exec on the destination.
- Random scheduler (50/50 traffic/file when >=2 SSH-capable deckies
  are running). Diurnal shaping, role-aware pairing, and session-aware
  backoff are explicit non-goals for MVP.
- CLI registration, systemd unit (SupplementaryGroups=docker),
  worker-registry entry so the dashboard shows orchestrator health.
- 11 tests: scheduler policy, driver argv shape + injection-safety,
  end-to-end one-tick integration with FakeBus + SQLite.

tests/orchestrator/test_scheduler.py

@@ -0,0 +1,60 @@
+"""Picker policy tests for the orchestrator scheduler."""
+from __future__ import annotations
+
+import secrets
+
+import pytest
+
+from decnet.orchestrator import scheduler
+
+
+def _decky(uuid: str, name: str, ip: str | None, services: list[str] | str):
+    return {"uuid": uuid, "name": name, "ip": ip, "services": services}
+
+
+def test_pick_returns_none_when_no_ssh_deckies():
+    deckies = [
+        _decky("u1", "decky-01", "10.0.0.1", ["http"]),
+        _decky("u2", "decky-02", "10.0.0.2", ["smb"]),
+    ]
+    assert scheduler.pick(deckies) is None
+
+
+def test_pick_returns_none_when_ssh_decky_has_no_ip():
+    deckies = [_decky("u1", "decky-01", None, ["ssh"])]
+    assert scheduler.pick(deckies) is None
+
+
+def test_pick_file_action_with_single_ssh_decky():
+    deckies = [_decky("u1", "decky-01", "10.0.0.1", ["ssh"])]
+    rng = secrets.SystemRandom()
+    rng.seed = lambda *_: None  # SystemRandom doesn't seed; ignore
+    action = scheduler.pick(deckies, rand=rng)
+    assert isinstance(action, scheduler.FileAction)
+    assert action.dst_uuid == "u1"
+    assert action.path.startswith("/")
+    assert action.content
+
+
+def test_pick_traffic_or_file_with_two_ssh_deckies():
+    deckies = [
+        _decky("u1", "decky-01", "10.0.0.1", ["ssh"]),
+        _decky("u2", "decky-02", "10.0.0.2", ["ssh"]),
+    ]
+    seen_kinds: set[str] = set()
+    # 50/50 split — 40 trials makes both kinds essentially certain
+    for _ in range(40):
+        action = scheduler.pick(deckies)
+        assert action is not None
+        seen_kinds.add("traffic" if isinstance(action, scheduler.TrafficAction) else "file")
+        if isinstance(action, scheduler.TrafficAction):
+            assert action.src_uuid != action.dst_uuid
+            assert action.dst_ip in {"10.0.0.1", "10.0.0.2"}
+            assert action.protocol == "ssh"
+    assert seen_kinds == {"traffic", "file"}
+
+
+def test_pick_skips_non_deserialised_services():
+    """If services is still a JSON string (defensive), the decky is excluded."""
+    deckies = [_decky("u1", "decky-01", "10.0.0.1", '["ssh"]')]
+    assert scheduler.pick(deckies) is None