Enable the ai overlay and add goose tooling: - goosed-bin: extract the goosed agent server from the prebuilt Desktop .deb (not shipped in the CLI tarball) and autopatchelf it; x86_64-linux only. - goosed runs as a ryu user service with the GOOSE_SERVER__SECRET_KEY sops token; GOOSE_TUNNEL=none disables the public Cloudflare/lapstone relay. - Front it at goose.darksailor.dev via ryu Caddy (Cloudflare DNS-01, tailnet-only, SSE flush) so the iOS app pairs directly over Tailscale. Also wires in claude-agent-acp and re-enables pi.dev.