chore(spec): record Task 7 host convergence as verified - #108

Task 7 is the bundle's one manual unit -- a run-and-observe loop on
hardware that produces no repo artifact a worker can generate -- so this
empty commit is the artifact: it carries the trailer the derivation
reads, and the evidence below is the record.

All four Done-when clauses, verified on the physical Linux host:

  Two consecutive runs converge
    Confirmed by the operator: the second run reported zero changed
    tasks and zero failures.

  Both services running and reachable after a reboot
    scripts/dev-services-runtime-test.sh passes 6/6 after a genuine
    reboot: PostgreSQL and Valkey each active, enabled, and accepting a
    connection on their declared 127.0.0.1 ports. The units'
    ActiveEnterTimestamp reads 2026-04-15 11:33 -- this host's pre-NTP
    RTC value -- which places their start inside early boot rather than
    a later manual `systemctl start`. Worth stating because the previous
    check looked identical and was not: the services had been installed
    six minutes AFTER that boot, so "active and enabled" proved nothing
    about surviving one.

  An interrupted run is followed by one that converges, no manual cleanup
    Reached by accident rather than by design, which makes it a fair
    test. Verified after the fact: `dpkg --audit` reports nothing, so no
    package was left half-configured, and both harnesses pass --
    including postgresql-access-test.sh creating, migrating and dropping
    a scratch database and asserting port 5432 is loopback-only.

  The role's macOS-only content absent, ~/.my.cnf specifically
    Absent, and absent across a reboot. It was NOT absent when this
    clause was first checked: a symlink dated Jul 24 predated the
    platform split, and the Darwin guard stops the file being recreated
    without removing one already there. Removed by hand on the host, by
    explicit operator choice over declaring it absent in the role -- so
    another host carrying the same leftover would still fail this clause
    with no guard to catch it.

Not closing the bundle. Task 1's mechanism shipped in #98, but
REQ-D1.2 and REQ-D1.3 stay unmet until the machine-local identifier file
exists and the generated block lands in .gitleaks.toml, which is empty
today. Status therefore stays as it is, and the Awaiting-input entry for
Task 1 stays with it.

Planwright-Task: dev-services/7

Claude-Session: https://claude.ai/code/session_01F8oKrXASMQSXMVjSvuJpn9