Topology B: remote-host control plane

Goal

Support a central control-plane deployment where Brigade nodes are NOT co-located on the flintlock hosts and dial remote flintlockd endpoints over the network. Complements the current topology A (a Brigade node on every host).

Why

Some fleets can't run BEAM on every microVM host, or want the orchestrator lifecycle decoupled from hosts. flintlock hosts stay lightweight; a small Brigade cluster (2–3 nodes) holds the host inventory and dials them.

Seams already in place

The behaviours were designed for this — no core rewrite expected:

• Brigade.HostDriver — add a Remote impl (network dial + mandatory mTLS/basic-auth). Local stays for A. Host already carries auth_token + tls.
• Brigade.HostRegistry — add a static-config / API provider (remote hosts are not Erlang nodes, so they can't self-register on nodeup).
• Brigade.Store — consider a Postgres impl for the central control plane (Mnesia is tied to the mesh).

Considerations

• Host liveness can no longer piggyback on Erlang nodedown — needs active health-checking of remote endpoints (the TCP/gRPC probe already exists in LocalFlintlock.HealthMonitor, generalize it).
• Quorum gating still applies to the (smaller) control-plane cluster.
• Reconciler currently runs per-host over localhost; remote mode needs a control-plane-driven reconcile fanning out to endpoints.

Deferred from the M0–M4 build.

Start by reading Brigade.HostDriver, Brigade.HostRegistry, Brigade.Store, LocalFlintock.HealthMonitor, and the current reconciler entry point. Trace how local registration, liveness, quorum gating, and per-host reconciliation work. Done means remote hosts can be configured, authenticated, health-checked, persisted centrally, and reconciled without relying on nodeup.