fix(validate): the homelab-* timers are the estate's, not every host's (#263)

[Gerrrt]

Found by running make validate on alexander once the lab stack was up:

FAIL the stack runs here but no homelab-* units are installed — run 'make install-timers' (#215)

Both halves are wrong on that host, and this is a regression from #263.

Why it fired

#263 widened the deployment-host test from "is the observability stack running" to stack_running(), which asks whether any stack is. Correct for the question it was given, and the wrong question — the homelab-* timers are the estate's maintenance:

Unit	What it does on the lab guest
converge	runs make up — which is STACK=observability, the estate stack
snmp-verify	polls devices the lab does not have
backup-firewall	ships to a host 30 → 99 cannot reach
dashboards-drift	exports the estate's seven dashboards

None of that is work alexander should be doing.

And the advice cannot be followed

Every unit's ExecStart hardcodes /home/robo/code/Gerrrt/HomeLab, and install-timers.sh already refuses to install anywhere but that checkout (line 331). So the fix the failure names is refused by the very next command — a dead end, pointing at work that should never happen on that host.

Worth saying plainly: nothing broke. The existing refusal held, so this cost confusion rather than six failing timers on the lab guest.

The fix

The gate is the path the units already carry. install-timers.sh asserts every ExecStart and WorkingDirectory agrees with its DEPLOY_ROOT, so that path is the definition of "the host these timers belong to" — read out of systemd/*.service rather than restated here as a third literal that would drift from the other two.

• On the monitoring host's deploy checkout: unchanged, still fails when the stack runs with no units installed, which is what #77's timers were never installed: no scheduled backup has run, and validate cannot see it #215 asked for.
• On the lab guest, and in a worktree: skips, and says whose jobs those are.

SKIP the homelab-* units name /home/robo/code/Gerrrt/HomeLab, not this
     checkout — their jobs are not this host's

Verification

make lint passes; make validate in a worktree now produces the skip above in place of the failure. The positive path is preserved because unit_deploy_root() resolves to exactly the main checkout's path.

🤖 Generated with Claude Code