gunbc serve: hand peer_user only on the unix-socket listener (fixes srv1 roadmap 500)

[gunbai-bot]

This fixes the srv1 roadmap outage. After dashboard_deploy run 36584004074 at 178fb76c71, gunbc-roadmap.service answered HTTP 500 on every request. A rollback to 361db9017b is in progress separately.

Cause. #12482 made gunbc serve hand a new named argument, peer_user, to every handler. Named arguments must match the handler's parameters exactly, so an argument the handler doesn't declare is a call-contract refusal (no parameter named 'peer_user'), not a value that gets dropped. The roadmap handler doesn't declare it, so every request failed. The seed comment claiming otherwise was never executed.

Fix. serve_handler_args builds the argument list and appends peer_user only when the listener attests a peer, which means --unix-socket. TCP handlers get exactly the argument set they had before #12482. The fabric door's socket handler still receives peer_user.

Evidence

• Seed test cli_run serve_unix_socket_door_tests a_tcp_handler_is_not_handed_peer_user pins the argument names: the TCP call has the five prior names, and the unix-socket call ends with peer_user. It fails if the argument is appended unconditionally. All 4 tests in the module pass.
• Live check: gunbc serve of a handler without peer_user over TCP returned HTTP 500 with the Fabric door on a group-restricted unix socket with kernel-attested peers; placed host writes through it; retire fabric_storage_append_principal_unrefused #12482 seed and HTTP 200 with this fix.
• Files gunbc.recurring_failure_mode a_serve_contract_widened_for_one_handler_refuses_every_other. The row names the missing gate: nothing checks the seed's argument set against every declared serve handler's signature before a deploy.

🤖 Generated with Claude Code

[gunbai-bot]

Review 72786 addressed in 711c851: the row now states RUNG NOW 1 (mitigatable). The seed test is a v1-compiler --lib unit test that blocks no merge while gunbc.rung_drop rust_unit_tests_off_the_merge_path stands, so it's local diligence, not a mechanism. The row says rung 2 needs that drop retired, or the required per-serve-unit argument/signature claim it already names as the next trigger. — sent from jolly-owl-158