fix(esphome): actually disable remote-build — two switches, only one closes the port

ha-dev found the WS API and tested the read half; this runs the write. But the
command they identified is the wrong half, which is worth recording because the
naming actively misleads.

  remote_build/set_offloader_settings {remote_builds_enabled: false}
      the OUTBOUND half — this dashboard sending builds to peers.
      Persists, reads back false, and leaves the receiver listening.

  remote_build/set_settings {enabled: false}
      the receiver-side master switch, per ReceiverController.set_settings's
      own docstring. Tears the listener down live, no restart needed.

Set both. Verified across a restart: 6055 absent, zero peer-link bind lines,
zero mDNS advertisements, both switches read back false. Persisted at
_remote_build.enabled in /config/.device-builder.json — which did not exist
until the flag was first changed, so 'no on-disk representation' was true only
of the default state.

ESPHOME_REMOTE_BUILD_HOST=127.0.0.1 is KEPT as a backstop rather than removed.
The off state now lives in one JSON file whose in-code default is enabled:True
(controllers/remote_build/_state.py) and whose module's stores soft-recover to
an empty model on a malformed blob rather than erroring — so a lost or corrupt
settings file silently re-enables remote-build. With the env var set, that
regression binds loopback instead of 0.0.0.0.

Also finishes deploy-stack.sh properly. This was patched three times in one
session because -a is -rlptgoD and a non-root identity cannot apply owner,
group, permissions OR times to a root-owned directory; each patch fixed one
letter and the next deploy failed on the next one, every time exiting 23 AFTER
a successful transfer. The rule is now written into the script: the deploy
syncs content, the conventions own metadata. --no-o --no-g --no-perms
--omit-dir-times. Verified: clean run, destination keeps 2775 root:docker with
setgid intact.

stacks/esphome/README.md

@@ -18,6 +18,23 @@ ssh infra-ops@esh-docker-vm 'cd /opt/docker/compose/esphome && sudo -n docker co
 The `.env` is never synced in either direction (see the root `CLAUDE.md`
 exclusion list). It is created on the host once, from the vault.
 
+## Remote build is off
+
+Device Builder 1.0.0 ships remote-build **on by default** and it binds
+`0.0.0.0:6055` with mDNS advertisement. Disabled 2026-09-14 via the dashboard's
+own `/ws` API — `remote_build/set_settings {"enabled": false}` — persisted at
+`_remote_build.enabled` in `/config/.device-builder.json`.
+
+⚠ **There are two switches and only one closes the port.**
+`remote_build/set_offloader_settings {remote_builds_enabled}` is the *outbound*
+half; setting it false persists, reads back false, and leaves the receiver
+listening. `remote_build/set_settings {enabled}` is the receiver-side master
+switch. The one whose name reads like the master switch is not.
+
+`ESPHOME_REMOTE_BUILD_HOST=127.0.0.1` is kept as a backstop: the off state lives
+in one JSON file whose in-code default is `True`, so a lost or corrupt settings
+file re-enables the feature silently.
+
 ## Three things not to undo
 
 - **`privileged: true` and `network_mode: host` are required.** USB flashing