Decide what oracle is for #94

oracle (10.0.99.30) has no defined purpose.

The specification, corrected after the inventory turned out to be optimistic: a
dual-core AMD A6-9200, 4 GB of RAM, and a 5400 rpm disk. That is considerably
less machine than earlier notes claimed, and too little for anything demanding.

Things it is not suitable for: the second observability stack ADR-0007 wants
on Saruman, the sensitive-tier services in ADR-0008, or anything with a
database under load.

Things it might plausibly do:

• An off-host watcher for the dead-man's-switch problem — the notification path
  needs something that is not the monitoring host, and this is a machine that is
  not the monitoring host.
• A second SOPS/age recipient holder, addressing the "one key, one person" gap
  in back-up-the-age-key.md.
• A backup target, so make backup and make backup-firewall stop writing
  next to the thing they protect.
• Nothing, and be switched off. A 5400 rpm disk drawing power to run an idle
  Linux is a defensible thing to stop doing.

It should get an Alloy agent either way while it is powered, so its failure is
visible.

Tracked in docs/roadmap.md; filed as an issue so it has a place to be discussed and closed.