deploy(gw-04): run the timer as a dedicated clawmates user under /opt

Move the running stack off root ownership. The systemd service now runs
as User=clawmates:clawmates with WorkingDirectory=/opt/clawmates, and the
script's COMPOSE_DIR default follows. This closes the "rootful compose
stack" ask from the original ship-readiness audit — deploys no longer
require any part of the pipeline to run as root beyond docker access
(the clawmates user gets that via the docker group).

Docker-managed volumes (pgdata, broker_run, broker_key, brains, filedata)
stay put; the compose project name is unchanged so docker resolves them
to the same physical volumes. The old /root/clawmates directory stays in
place as an emergency rollback for a week, then gets removed as follow-up.

deploy/gw-04/clawmates-deploy.service

@@ -5,6 +5,9 @@ After=docker.service network-online.target
 
 [Service]
 Type=oneshot
+User=clawmates
+Group=clawmates
+WorkingDirectory=/opt/clawmates
 ExecStart=/usr/local/bin/clawmates-deploy.sh
 StandardOutput=journal
 StandardError=journal

deploy/gw-04/clawmates-deploy.sh

@@ -25,7 +25,7 @@ set -euo pipefail
 
 REGISTRY="${REGISTRY:-100.94.185.103:5000}"
 NAMESPACE="${NAMESPACE:-clawmates}"
-COMPOSE_DIR="${COMPOSE_DIR:-/root/clawmates}"
+COMPOSE_DIR="${COMPOSE_DIR:-/opt/clawmates}"
 LOG="${LOG:-/var/log/clawmates-deploy.log}"
 SERVICES=(broker server frontend)