DR-017 — goose client topology: per-client container on the client's own VPS at rollout

Target model: each client VPS runs its own goose container (per-client recipe + service-actor), so the agent processing a client’s knowledge — and its API spend — lives on that client’s box, honouring the “your data never shares a machine” promise. The pilot stays on Server B until the G6 adopt gate; per-client rollout is a post-pilot task.