chore(container-stack): retire nested svalinn, convert to submodule

Completes the container-stack/ cleanup started in #119. svalinn's nested
copy was ReScript (banned estate-wide), diverged from the standalone
hyperpolymath/svalinn repo, which has independently progressed further
on the AffineScript/TypeScript rewrite (28 .affine files vs. the nested
copy's 11, far fewer leftover legacy files).

Before retiring: ported the nested copy's unique, non-language-specific
assets forward — a working Rokur secrets-gate integration (documented as
an exact behavioural contract, since the ReScript code itself isn't
portable) and deployment/security hardening docs/config (firewalld,
ModSecurity, OpenLiteSpeed) — via hyperpolymath/svalinn#64 (merged/pending)
and filed the actual gate reimplementation as hyperpolymath/svalinn#65.

container-stack/ now has all 5 components (cerro-torre, vordr, selur,
rokur, svalinn) as submodules — no more full copies committed in-tree.

Author: hyperpolymath

.gitmodules

@@ -10,3 +10,6 @@
 [submodule "container-stack/cerro-torre"]
 	path = container-stack/cerro-torre
 	url = https://github.com/hyperpolymath/cerro-torre.git
+[submodule "container-stack/svalinn"]
+	path = container-stack/svalinn
+	url = https://github.com/hyperpolymath/svalinn.git

container-stack/README.adoc

@@ -20,7 +20,7 @@ their own standalone repos, so there is one source of truth per component.
 | Container builder — produces cryptographically signed, minimal Chainguard-based images. Upstream repo: `hyperpolymath/cerro-torre`.
 
 | `svalinn/`
-| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. *Not yet converted to a submodule* — this copy and the standalone repo have diverged (different completion state, different files) and need reconciliation before the switch; tracked separately, do not delete either copy in the meantime.
+| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. Was a diverged ReScript-era copy (ReScript is banned estate-wide); retired 2026-07-04 in favour of the standalone repo's further-progressed AffineScript/TypeScript line, after porting the copy's unique Rokur-gate contract and ops docs forward (hyperpolymath/svalinn#64, #65).
 
 | `rokur/`
 | Stapeln GUI runtime — the Stapeln GUI component itself (Tauri/Dioxus shell). Upstream repo: `hyperpolymath/rokur`.