Add 116 maintenance gate and Futu OpenD service

[bioinformatist]

Summary

• add a downstream Maintenance Gate workflow and Renovate config for upstream-only update PRs
• add a Futu OpenD binary package and a ysun user service on host 116
• add SOPS-backed Futu login secrets and narrowly allow the current Futu OpenD tarball/service wrappers in the cache policy

Notes

Futu OpenD is treated as a downstream-owned manual component, not an automated maintenance leaf. Future Futu version bumps should update the package hash and the matching policy markers explicitly.

The maintenance gate still stubs yazelix-next because GitHub Actions cannot rely on Lucca's private repository SSH access. The gate compares the PR against main and blocks only newly introduced unapproved local derivations.

Validation

• jq empty renovate.json scripts/maint/policy.json flake.lock
• bash -n scripts/maint/ci-cache-gate.sh
• nix flake metadata --json --no-write-lock-file >/dev/null
• nix shell nixpkgs#actionlint -c actionlint .github/workflows/maintenance-gate.yml
• bash scripts/maint/ci-cache-gate.sh
• env NIXPKGS_ALLOW_UNFREE=1 nix build --dry-run .#nixosConfigurations.116.config.system.build.toplevel --no-link
• env NIXPKGS_ALLOW_UNFREE=1 nix build --no-link --impure --expr 'let flake = builtins.getFlake (toString ./.); in flake.nixosConfigurations."116".pkgs.callPackage ./pkgs/futu-opend.nix { }'