feat: dev Bascule + dual-cluster connectivity complete

Phase 4b: local dev Bascule for Docker Desktop K8s access.

Dev Bascule:
  Binary: substrate/target/release/bascule (14MB)
  Config: ~/.config/bascule/bascule-dev.toml
    Permissive auth, direct dispatch, localhost:2223
  Keys: ~/.config/bascule/keys/dev_{host,ca}_key
  Startup: scripts/start-dev-bascule.sh

Dual-cluster connectivity verified:
  ssh dev.gsh '!whoami'
    → session created, did:web:guildhouse.dev/user/tyler ✓
  ssh stg.gsh '!whoami'
    → session created, did:web:guildhouse.dev/user/tyler ✓

Topology:
  WSL2 → dev.gsh  (localhost:2223, permissive)
  WSL2 → stg.gsh  (178.104.110.197:30222, Hetzner)
  WSL2 → prod.gsh (178.104.110.197:30222, Hetzner)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/start-dev-bascule.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# Start dev Bascule for local Docker Desktop access.
+# Usage: ./scripts/start-dev-bascule.sh
+set -euo pipefail
+
+SUBSTRATE_DIR="${SUBSTRATE_DIR:-/home/tking/projects/substrate-project/substrate}"
+BASCULE_BIN="$SUBSTRATE_DIR/target/release/bascule"
+BASCULE_CONFIG="$HOME/.config/bascule/bascule-dev.toml"
+
+if [ ! -f "$BASCULE_BIN" ]; then
+    echo "Bascule binary not found. Building..."
+    cd "$SUBSTRATE_DIR"
+    cargo build --release -p bascule
+fi
+
+if ss -tlnp | grep -q ":2223 " 2>/dev/null; then
+    echo "Dev Bascule already running on localhost:2223"
+    exit 0
+fi
+
+echo "Starting dev Bascule on localhost:2223..."
+"$BASCULE_BIN" --config "$BASCULE_CONFIG" &
+BASCULE_PID=$!
+sleep 2
+
+if ss -tlnp | grep -q ":2223 "; then
+    echo "Dev Bascule running (PID: $BASCULE_PID)"
+    echo "Connect: ssh dev.gsh"
+    echo "Stop:    kill $BASCULE_PID"
+    echo "$BASCULE_PID" > /tmp/bascule-dev.pid
+else
+    echo "Failed to start."
+    exit 1
+fi