nx_deploy_marker.nx

nx_deploy_marker.nx -- the SELF-SAFE deploy primitive (CAP-DEPLOY-MARKER). A deploy targeting a LIVE service -- especially the mgmt API deploying ITSELF -- must NOT restart the process that is serving the deploy request (that kills the response mid-flight and can wedge the control plane). Instead the deploy STAGES the new binary + REQUESTS a restart via a per-service marker; the SUPERVISOR (nx_hostctl guard), on its next poll, CONSUMES the marker and restarts the service. Decoupled restart = self-safe (the daemon never kills itself in-request) AND never-brick-safe (the supervisor owns the atomic swap + can roll back). Consumed EXACTLY ONCE => no restart loop. marker file <dir>/restart_<service>.req : "1" = restart pending, "0" = already consumed license_tier: ORIGINAL