[shipmill-romamo]

Spec for #88

• A component may declare spec.release: {command, workingDirectory, timeoutSeconds}; timeoutSeconds defaults to 300, max 1800
• The deploy role runs it after uv sync and before the unit install and the current switch, as the application's linuxUser, in the new release directory, with the unit's own EnvironmentFile (shared/env/<component>.env) parsed by systemd's rules
• It runs once, on the first of deployment.servers, which the deploy now processes first; the other servers skip it
• A non-zero exit or timeout fails the deploy with ENGINE_STEP_FAILED before any server switches current or restarts; no receipt is written
• ReleaseReceipt gains an optional releaseCommand (server, command, exit code, last 2000 characters of output)
• The deploy plan shows the command and its server; rollback never runs it and its plan says so
• Behaviour asks for expand and contract migrations, since old code keeps serving while the command runs

Spec only, no product code.

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: do you approve this spec as written? Merging a spec is its approval (the spec gate), so shipmill holds it for your review instead of merging it on green CI.

1. Approve (recommended once you've read it): merge it yourself, or reply "1" and shipmill merges it on the next tick, then splits it into build issues and starts the build
2. Request changes: reply or review with what to change; shipmill revises the spec in this PR and asks again
3. Refuse: close the PR; the issue reads SPEC_REFUSED and triage decides again (postpone or won't fix)

Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.