Handoff for the Iceberg worker: the contract iceberg.sh must satisfy (same
interface shape as dbq.sh, read-only enforced by the system, no new network
endpoints, call-time container resolution), the environment constraints that
will otherwise bite -- prod's Swarm overlay is unroutable from its own host so
tunnels are impossible, Contabo object storage requires path-style addressing,
the backups/ prefix is live, and beta's /etc/thermograph.env is unreadable by
the deploy user -- plus the decisions to report back, acceptance criteria with
a demonstrated refused write, and anti-goals.
