Add verae-keep: host supervisor with watch+guard on NS1.

Restarts crashed units unless the admin console paused or stopped
them. Fleet writes per-instance intent.json. Tested on 138:
crash-restart, pause-hold, watch respawn of keep.

packages/zapier-decisions/LOG.md

@@ -32,6 +32,12 @@
 - Disable lan-134 unless `FLEET_ENABLE_LAN134=1`.
 - SSH spawn timeout 8s; failed hosts skipped.
 
+## 2026-09-11 — verae-keep on NS1
+
+- New repo `verae-keep`: keep `:3860` restarts crashed units; watch `:3861` restarts keep; `guard.sh` restarts watch.
+- Honors admin pause/stop via intent files + `POST /intent`. Fleet writes `data/<instance>/intent.json` (local and SSH).
+- Tested on 70.88.205.138: crash-restart, pause-hold, watch respawn. webhook-deliver brought back. NATS observed only.
+
 ## 2026-09-11 — IAM JSON doors closed
 
 - CS/sales/accounting/staff JSON list and sales PUT pricing now go through IAM (401 JSON, 302 HTML).

packages/zapier-decisions/TODO.md

@@ -9,3 +9,4 @@
 - [x] Move portal static files fully into `verae-access-web` (`/portal/` public door; API proxied to loopback edge).
 - [x] Turn IAM on for the running lab (fleet `STAFF_IAM_URL` + restart).
 - [x] IAM hardening: JSON sessions, login rate-limit, JSON 401 as well as HTML 302, credit principal = IAM username.
+- [x] Host keep-alive (`verae-keep`) on NS1 with watch+guard; honors admin pause/stop.