feat(uno-q): expose participant files to the agent + document mux scan

- Mount each student's own App Lab files into the app container so the
  agent can read/fix them: mount-user-workspace.sh binds ~/sketches (rw),
  ~/ArduinoApps/* (rw), ~/Arduino/libraries (ro) under /app/workspace via
  a root oneshot ordered before arduino-app-cli.service (the /app bind is
  rprivate, so binds must precede container start; App Lab has no app.yaml
  volumes field). Wired into provision-node-app, provision-fleet (systemd,
  best-effort sudo), and package-onboard-app (bundled under host-setup/).
- uno-q-hardware skill: document the mux-aware i2c_scan output format
  (0x70:mux, 0x70.2=0x1d) and tell the agent its student's files live at
  /app/workspace. See USER-WORKSPACE.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

deploy/uno-q/systemd/apess-user-workspace.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=APESS — bind participant workspace into the apess-onboard app container
+# The app's /app bind is rprivate, so these submounts must exist BEFORE the App Lab
+# daemon starts the default app container. Order strictly before it.
+Before=arduino-app-cli.service
+After=home-arduino.mount local-fs.target
+RequiresMountsFor=/home/arduino
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+# Which app dir maps to /app. Default = the distributable apess-onboard; the dev
+# provisioner overrides it (to zeroclaw-node) by writing .apess-workspace.env.
+Environment=APP_DIR=/home/arduino/ArduinoApps/apess-onboard
+EnvironmentFile=-/home/arduino/.apess-workspace.env
+ExecStart=/home/arduino/mount-user-workspace.sh
+# Clean unmount on stop so the next start rebinds fresh.
+ExecStop=/bin/sh -c 'for m in "$APP_DIR"/workspace/sketches "$APP_DIR"/workspace/libraries "$APP_DIR"/workspace/apps/*; do mountpoint -q "$m" && umount "$m" || true; done; exit 0'
+
+[Install]
+WantedBy=multi-user.target