runtime: outbox UNICO (imports absolutos) + relay-watcher con kill switch + guard R1-R8

- outbox.mjs solo en /srv/cayce-core; daemon/social/mail/ops lo importan por ruta absoluta. deploy.sh ya no instala copias.
- relay-watcher.mjs: cada 5 min cruza eventos de la pubkey en 5 relays con outbound_drafts; sin aprobacion => PUBLISH_OFF + DM + audit. Probado: detecto 2 kind0 bypass reales (post-hoc registrados).
- guard R1-R8 (18 tests) + blocklist + check-single-outbox al check diario.
- stale duplicados archivados en forensics/scripts-archive-20261102 (nostr-daemon.mjs, dm-debug, publish-10050, dm-test2, find-followers).

runtime/deploy.sh

@@ -9,14 +9,12 @@ install -m 644 "$SRC/outbox.mjs"      /srv/cayce-core/outbox.mjs
 install -m 644 "$SRC/core.mjs"       /srv/cayce-core/core.mjs
 install -m 644 "$SRC/editorials.mjs" /srv/cayce-core/editorials.mjs
 install -m 644 "$SRC/initiative.mjs" /srv/cayce-core/initiative.mjs
-install -m 644 "$SRC/outbox.mjs"     /srv/cayce-nostr/outbox.mjs
+# ronda-7: outbox UNICO en /srv/cayce-core, import absolutos
 install -m 644 "$SRC/daemon.mjs"     /srv/cayce-nostr/daemon.mjs
 # opcionales (llegan con el PR de verificación/10050)
 install -m 755 "$SRC/publish-10050.mjs"        /srv/cayce-nostr/publish-10050.mjs 2>/dev/null || true
 install -m 644 "$SRC/check-relay-silence.mjs"  /srv/cayce-nostr/check-relay-silence.mjs 2>/dev/null || true
-install -m 644 "$SRC/outbox.mjs"     /home/ubuntu/cayce-social/outbox.mjs
 install -m 644 "$SRC/promo.mjs"      /home/ubuntu/cayce-social/promo.mjs
-install -m 644 "$SRC/outbox.mjs"     /home/ubuntu/cayce-mail/outbox.mjs
 install -m 644 "$SRC/mail.mjs"       /home/ubuntu/cayce-mail/mail.mjs
 
 # config de contención (idempotente): draft por defecto + ruta de identidad