gate each deploy on a swarm build of the agent from internal/meta

swarm-builder/README.md

@@ -21,6 +21,16 @@ the answer into a `swarm-builder` commit status on the PR's head.
 - Nothing is pushed and nothing is recorded: the closure stays in the host's
   store until it is collected.
 
+## Meta builds
+
+The service also builds one agent from `internal/meta` on request: an agent and
+a commit of the repo. It runs `nix build` of
+`nixosConfigurations.<agent>.config.system.build.toplevel` from that commit,
+with every input at the flake's own lock, and answers with the store path and
+the platform it builds for. The controller records the answer; the service
+writes nothing. It takes the same one-build slot as the PR checks. See
+[`docs/swarm/builder.md`](../docs/swarm/builder.md#deploy-gate).
+
 ## Credentials
 
 The container holds one credential: its own store certificate, which nspawn