deploy count statsd key, cuts, test repairs, comment register

[CMGS]

Whole-repo read after v0.1.6: one bug fix, a verified cut-list, test repairs and the comment register. Eight commits, each self-contained.

Bug

The deploy count reached statsd under the key template itself. SendDeployCount sent core.%s.deploy.count without the hostname, so every core bumped one shared counter and the per-host series got nothing since #491. Prometheus was not affected (the hostname is a label there). Regression test: a UDP listener reads the packet; it read core.%s.deploy.count:3|c before the fix and core.host1.deploy.count:3|c after.

Cuts (net -53 production lines, no behavior change)

Cut	Why it is safe
LinuxFile.Clone	no production caller since 678d1f3; no caller in agent, cli or resource-extend
DeployOptions.Lambda, VirtualizationCreateOptions.Lambda, DeployOptions.Debug	write-only since the docker and virt engines went (#671, #672); the pb fields stay
newEngine second map read and its !ok branch	the lookup only ever returned a key it had found
cobalt getNodeResourceInfo closure	returns the plugin call directly
withoutNetSysctls, additionalGids, cpumem share default, bestSplit init	maps.Clone + maps.DeleteFunc, a nil slice, cmp.Or, slices.Repeat
doGetDeployStrategy tail	returns strategy.Deploy directly; the only plan that returns a map with an error returns an empty one, and both callers discard it
store and cpumem key lists	utils.Map

The key lists sit on the status read path, so they got an A/B (100 ids, 3 rounds, arms interleaved, order swapped): 201 allocs and 8199 B in both arms, time within noise.

Three scripts are removed: check_calico.py (audits the virt engine's calico setup), meta_transfer_as_rename2workload.py (2020 rename) and meta_transfer_resource_plugin.py (2022 migration; it writes resource_args/engine_args, which core no longer reads). redis_as_broker.py stays and now strips only the leading root from a key.

Tests

• TestETCD asserted its watch from a goroutine it never joined. The watch now starts at the create's revision and asserts on the test goroutine.
• TestDeployOptions checked that t was non-nil through the shadowed assert. It now checks GetProcessing.
• TestGrant only exercised the mock and is removed.
• heldLock and mockLocks replace 34 copies of the calcium lock mock block (net -99 test lines). The lock tests that pin an order, a Once or a failing Lock keep their own mocks.
• t.Context() over context.Background(), assert.ErrorIs, two-argument AddNode mocks, no ResetTimer before b.Loop, unexported etcd test helpers, bytes.Buffer instead of zap's (zap drops to indirect).

Style

• rpc and calcium: per-iteration loop variables make the Copy wrapper closure redundant, cmp.Or picks the RunAndWait timeout, fmt.Appendf, lower camel for the RunAndWait options local.
• Own-line comments start uppercase (35 lines). A comment that leads with a code identifier or a tool's own name keeps that case.

Evidence

GOWORK=off: make lint 0 issues on linux and darwin, make fmt-check, asl ./... on both, go test -race -count=1 ./... all pass. go test -race -count=3 ./cluster/calcium passes with the shared lock helpers. Comment count: +0 in every commit.

Release note: agent #142 needs a core release that carries #757, so core ships before agent.