feat(deploy): Uno Q workshop-node provisioning kit

Codify the verified board setup into a repeatable kit under deploy/uno-q/:

- config.template.toml — the tested node config: cloud / cloud+fallback /
  on-board-Qwen providers, three agents (default / cloud / local) on the
  hardware risk profile, gateway, peripherals. Secrets stripped; cloud
  endpoint substituted at provision time.
- provision-uno-q.sh — one-shot adb-driven provisioner (no root): install
  config, start llama-server + `zeroclaw daemon`, pair for a bearer token,
  and POST /nodes to APESS.
- systemd/{zeroclaw-llama,zeroclaw-daemon}.service — production units
  (daemon, not `gateway start`, so peripheral tools register).
- README.md — dev (adb) and production (systemd + LAN bind) runbooks.

The individual steps are hardware-verified: all three agent aliases resolve
and route correctly on the board (local→Qwen, cloud→cloud, default→cloud
with Qwen fallback). Full script orchestration + live phone-home land once
the api (with /nodes) is redeployed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

deploy/uno-q/systemd/zeroclaw-llama.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=ZeroClaw on-board Qwen (llama-server)
+After=network.target
+
+[Service]
+Type=simple
+User=arduino
+Environment=LD_LIBRARY_PATH=/home/arduino/llama
+# -np 1 is mandatory (a bigger slot count makes the tiny model 500 on ctx).
+ExecStart=/home/arduino/llama/llama-server -m /home/arduino/models/qwen.gguf \
+  --host 127.0.0.1 --port 8083 -np 1 -c 16384 --jinja --mlock
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target