Add federation worker and canonical handoffs

deploy/orchestra-worker.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Orchestra federation worker
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=orchestra
+EnvironmentFile=/etc/orchestra/worker.env
+ExecStart=/usr/local/bin/orchestra-worker
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

deploy/orchestra.env.example

@@ -8,6 +8,18 @@
 ORCHESTRA_DATA=/var/lib/orchestra/data
 ORCHESTRA_PORT=9145
 
+# --- Federation worker (set only on a harness host such as workpc) ---
+# ORCHESTRA_URL=http://homesrv:9145
+# ORCHESTRA_WORKER_ID=workpc-opencode  # must equal ORCHESTRA_WORKER_HERDR_ID
+# ORCHESTRA_WORKER_TOKEN=<per-worker-secret>
+# ORCHESTRA_FEDERATION_ADMIT_TOKEN=<homesrv-admission-secret>
+# ORCHESTRA_WORKER_HERDR_ID=workpc-opencode
+# ORCHESTRA_WORKER_HARNESS=opencode
+# ORCHESTRA_WORKER_HERDR=/home/orchestra/.config/herdr/herdr.sock
+# ORCHESTRA_WORKER_STATE=/var/lib/orchestra-worker/state.json
+# ORCHESTRA_GIT_REMOTE=origin
+# ORCHESTRA_MACHINE_ID=homesrv  # set on the authoritative coordinator
+
 # Static project/machine/herdr topology (registry.Load). Required for
 # routing across more than one machine; validated at startup.
 ORCHESTRA_CONFIG=/etc/orchestra/config.json