[jaspermayone]

Summary

Adds a Selvage staging instance on twill, in the same way as Quilt staging on batting. See the README section "Selvage staging".

• modules/selvage: an mkInstance function and a staging option. Units selvage-staging-web and selvage-staging-worker, port 3010, RAILS_ENV=staging, its own env file. Each staging container is capped at 512 MB with no swap, and has --oom-score-adj 500, so the kernel kills staging first when twill runs out of memory.
• hosts/twill: staging on, weave staging issuer, the selvage-staging nginx vhost, one shared list of locations for production and staging, enableReload so a vhost change reloads nginx in place of a restart, and a hem entry in /etc/hosts.
• hosts/alastor/edge.nix: router selvage-staging-twill.
• secrets/secrets.nix: selvage-staging-env.age and restricted-staging-selvage.age. No .age file is added.
• bin/new-selvage-staging-secrets: reads only STAGING_-prefixed values, so production values left in the shell cannot reach staging.

Production

The production units do not change. I compared the ExecStart of selvage-web and selvage-worker on main and on this branch: they are the same. The production vhost locations evaluate to the same JSON. nginx.service changes (the staging vhost and enableReload). twill is not built yet, so a merge changes only alastor (the new router) on a running host.

Checks

• nix flake check --no-build --all-systems: all checks passed. nix fmt -- --ci on the changed files: no changes.
• shellcheck on the new script: passes. The script was also tested with throwaway age keys.
• An adversarial review found no high-severity problem. Its fixes are in the last commit: staging-only secrets, the OOM priority, the nginx reload, a runbook check that reads only the latest log, and a stale comment.