feat(curator): vendor the application backend as the scenario's tracked source

The curator Python backend (package, tests, systemd units, config templates, scripts) now lives under scenarios/curator/backend and is the single source of truth; the live checkout at the workspace path is a runtime copy. Exported from the app repo's tracked tree via git archive (no history, .pi/venv/caches excluded). 149 unit tests pass from the new location.

profile.toml backend is now repo-relative (scenarios/curator/backend); verify-generated.sh resolves a relative backend against REPO_ROOT. verify-no-secrets ASSIGN heuristic now requires value entropy so vendored kwargs like token=extraction_token no longer false-positive. README documents the backend/ layout and the operator-owned app rollout step.

scripts/verify-generated.sh

@@ -28,6 +28,7 @@ while IFS= read -r profile; do
   name="$(basename "$(dirname "$profile")")"
   backend="$(toml_get "$profile" scenario backend)"
   [ -n "$backend" ] || continue
+  case "$backend" in /*) ;; *) backend="$REPO_ROOT/$backend" ;; esac
   [ -d "$backend" ] || { warn "$name: backend not found: $backend"; continue; }
 
   while IFS= read -r prompt; do

scripts/verify-no-secrets.sh

@@ -81,8 +81,11 @@ declare -a PATTERNS=(
   '-----BEGIN [A-Z ]*PRIVATE KEY-----'
 )
 
-# key-ish assignment with a long opaque value
-ASSIGN='(?i)(api[_-]?key|apikey|secret|token|password|passwd|access[_-]?key)["'"'"' ]*[:=]["'"'"' ]*[A-Za-z0-9/_+=-]{16,}'
+# key-ish assignment with a long opaque value. The value must carry entropy (a
+# digit or an uppercase letter): real secrets are base64/hex/random, while
+# snake_case source identifiers like `token=extraction_token` are not, and used
+# to trip this rule once the Python backend was vendored into the repo.
+ASSIGN='(?i)(api[_-]?key|apikey|secret|token|password|passwd|access[_-]?key)["'"'"' ]*[:=]["'"'"' ]*(?-i:(?=[A-Za-z0-9/_+=-]{16,})(?=[A-Za-z0-9/_+=-]*[A-Z0-9]))[A-Za-z0-9/_+=-]{16,}'
 
 for f in "${FILES[@]}"; do
   [ -f "$f" ] || continue