fix: [nomad-step-5] S5.2 — nomad/jobs/staging.hcl + chat.hcl (#989)

Add lightweight Nomad service jobs for the staging file server and
Claude chat UI. Key changes:

- nomad/jobs/staging.hcl: caddy:alpine file-server mounting docker/
  as /srv/site (read-only), no Vault integration needed
- nomad/jobs/chat.hcl: custom disinto/chat:local image with sandbox
  hardening (cap_drop ALL, tmpfs, pids_limit 128, security_opt),
  Vault-templated OAuth secrets from kv/disinto/shared/chat
- nomad/client.hcl: add site-content host volume for staging
- vault/policies/service-chat.hcl + vault/roles.yaml: read-only
  access to chat secrets via workload identity
- bin/disinto: wire staging+chat into build, deploy order, seed
  mapping, summary, and service validation
- tests/disinto-init-nomad.bats: update known-services assertion

Fixes prior art issue where security_opt and pids_limit were placed
at task level instead of inside docker driver config block.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nomad/jobs/staging.hcl

@@ -0,0 +1,86 @@
+# =============================================================================
+# nomad/jobs/staging.hcl — Staging file server (Nomad service job)
+#
+# Part of the Nomad+Vault migration (S5.2, issue #989). Lightweight service job
+# for the staging file server using Caddy as a static file server.
+#
+# Mount contract:
+#   This job mounts the `docker/` directory as `/srv/site` (read-only).
+#   The docker/ directory contains static content (images, HTML, etc.)
+#   served to staging environment users.
+#
+# Network:
+#   No external port exposed — edge proxy routes to it internally.
+#   Service discovery via Nomad native provider for internal routing.
+#
+# Not the runtime yet: docker-compose.yml is still the factory's live stack
+# until cutover. This file exists so CI can validate it and S5.2 can wire
+# `disinto init --backend=nomad --with staging` to `nomad job run` it.
+# =============================================================================
+
+job "staging" {
+  type        = "service"
+  datacenters = ["dc1"]
+
+  group "staging" {
+    count = 1
+
+    # No Vault integration needed — no secrets required (static file server)
+
+    # Internal service — no external port. Edge proxy routes internally.
+    network {
+      port "http" {
+        static = 80
+        to     = 80
+      }
+    }
+
+    volume "site-content" {
+      type      = "host"
+      source    = "site-content"
+      read_only = true
+    }
+
+    restart {
+      attempts = 3
+      interval = "5m"
+      delay    = "15s"
+      mode     = "delay"
+    }
+
+    service {
+      name     = "staging"
+      port     = "http"
+      provider = "nomad"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "3s"
+      }
+    }
+
+    task "staging" {
+      driver = "docker"
+
+      config {
+        image = "caddy:alpine"
+        ports = ["http"]
+        args  = ["file-server", "--root", "/srv/site"]
+      }
+
+      # Mount docker/ directory as /srv/site:ro (static content)
+      volume_mount {
+        volume      = "site-content"
+        destination = "/srv/site"
+        read_only   = true
+      }
+
+      resources {
+        cpu    = 100
+        memory = 256
+      }
+    }
+  }
+}