row 198: retire the board writer on 7331; the Console serves the board in-process

The Console builds the board context itself (control-board createBoard)
and answers the board routes in-process. The standalone control-board
HTTP writer and page.html are removed; control-board serve exits 2 as
retired, and webui --board is refused. /api/seen and /api/reply need
--send and a named human, else 403 read-only.

Tests are rewritten against the in-process board (inProcessBoard in the
webui fixture; createBoard in control-board). Proxy, unreachable-board
and HTTP-only tests are dropped; the dropped set is listed in BUILD.md.

UNVERIFIED: committed under Sage's slot hold (Gander run 5). No suite or
mutant has run on this commit; do not push before the gate is green.

scripts/stack-copy.sh

@@ -34,6 +34,8 @@ COPY_PATHS=(
  packages/seat/src packages/tasks/src packages/tasks/fields.json packages/tasks/requirements.json
  packages/processing-control
  packages/webui/src packages/webui/README.md packages/cli/README.md
+# Row 198: the board runs in-process inside the Console, and its replies go through tools/tmux/agent-send.sh.
+ packages/control-board/src tools/tmux
  packages/queue/src packages/library/src packages/library/bin
  # Whole directory: every in-repo plug-in module ships with the copy (row 131).
  packages/plugins

scripts/webui-service.sh

@@ -42,7 +42,7 @@
 # FLAGS are serve's: --port N (default 7332; 7330 is the operator's own
 # Console), --tester-socket (private Unix tester), or legacy --tester-port N
 # (1024..65535, neither --port nor the tunnel's 7332; loopback on old copies),
-# --business ID, --board URL, and the preview set --public-host
+# --business ID, and the preview set --public-host
 # NAME --auth-header HEADER --allow-user ID, all three or none, and --send
 # (row 83), taken only with the preview set: the unit's Console then sends
 # human messages to roles and needs the system config at start. systemd
@@ -93,7 +93,7 @@ instance_select
 UNIT_NAME="$CONSOLE_UNIT"
 BUS_UNIT_PREFIX="${BUS_TEMPLATE%.service}"
 USAGE="usage: scripts/webui-service.sh copy COMMIT [--copies DIR] [--allow-worktree] | [--instance NAME] render [--copy ID [--copies DIR]] [FLAGS] | install --copy ID [--copies DIR] [--dir DIR] [--no-reload] [--allow-worktree] [FLAGS] | uninstall [--dir DIR] [--no-reload] | status [--dir DIR]
-  FLAGS: [--port N] [--business ID] [--board URL] [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-socket | --tester-port N (legacy copies)] [--proof-header NAME --proof-file PATH]
+  FLAGS: [--port N] [--business ID] [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-socket | --tester-port N (legacy copies)] [--proof-header NAME --proof-file PATH]
   --tester-port: legacy copies only; 1024..65535, different from --port and never 7332; loopback tester listener.
   --allow-worktree is for the tests only: copy and install otherwise refuse outside the canonical checkout."
 
@@ -113,7 +113,6 @@ TESTER_PORT=""
 TESTER_SET=0
 TESTER_SOCKET=0
 BUSINESS=""
-BOARD=""
 PUBLIC_HOST=""
 AUTH_HEADER=""
 ALLOW_USER=""
@@ -136,7 +135,6 @@ parse_flags() {
             --tester-socket) TESTER_SOCKET=1; SERVE_SET=1; shift ;;
             --tester-port) [ $# -ge 2 ] || usage; TESTER_PORT="$2"; TESTER_SET=1; SERVE_SET=1; shift 2 ;;
             --business) [ $# -ge 2 ] || usage; BUSINESS="$2"; SERVE_SET=1; shift 2 ;;
-            --board) [ $# -ge 2 ] || usage; BOARD="$2"; SERVE_SET=1; shift 2 ;;
             --public-host) [ $# -ge 2 ] || usage; PUBLIC_HOST="$2"; SERVE_SET=1; shift 2 ;;
             --auth-header) [ $# -ge 2 ] || usage; AUTH_HEADER="$2"; SERVE_SET=1; shift 2 ;;
             --allow-user) [ $# -ge 2 ] || usage; ALLOW_USER="$2"; SERVE_SET=1; shift 2 ;;
@@ -212,12 +210,6 @@ serve_flags() {
         [ "${#BUSINESS}" -le 64 ] || die "business must be a business id: $BUSINESS"
         flags="$flags --business $BUSINESS"
     fi
-    if [ -n "$BOARD" ]; then
-        # serve checks the rest (a loopback origin, no path or credentials).
-        case "$BOARD" in http://?*) ;; *) die "board must be an http:// URL: $BOARD" ;; esac
-        case "$BOARD" in *[!A-Za-z0-9.:/_-]*) die "board contains a character the unit cannot carry: $BOARD" ;; esac
-        flags="$flags --board $BOARD"
-    fi
     local preview=0
     [ -z "$PUBLIC_HOST" ] || preview=$((preview + 1))
     [ -z "$AUTH_HEADER" ] || preview=$((preview + 1))