Ingest chute pod logs streamed by the in-guest log shipper.

mTLS-only, via the cvm proxy: the guest presents its per-boot registry mTLS leaf and the resolve_log_context dependency binds the shipment to the launch-config owner (cross-miner injection is rejected there; the auth result is cached per (config_id, cert) so a burst of batches doesn't re-verify). Identity is derived server-side — the body carries only deployment_id + the log lines.

Cutoff contract (docs/specs/chute-log-shipper.md): 204 = stop capturing this pod, 200 = keep sending, 403/404 = terminal reject (unauthorized / unknown config), which the guest also treats as stop. The lines are ingested BEFORE the cutoff is evaluated so a final crash batch is always stored.