fix(web-svc-cdn): mark cdn workload node-local so swarm converge gate skips

The swarm post-deploy verify gate (03_wait_converge) derives a serving
service name cdn_cdn and polls it until timeout. web-svc-cdn has no such
service: it ships only the cdn_build one-shot and serves the built npm
mirror through the shared manager-pinned openresty host bind. The gate
therefore failed the whole matrix-deploy step even though the deploy
itself was green.

workload: node-local sets HAS_SWARM_SERVICE=false so skip_if_no_swarm_service
skips converge/chaos for this role, matching the already-declared
placement: manager host-bind design. Test-context only; deploy and compose
paths do not read workload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/web-svc-cdn/meta/services.yml

@@ -7,6 +7,7 @@ dashboard:
 cdn:
   # nocheck: default-placement-manager  the one-shot npm-mirror build must write the served CDN root, a node-local host bind openresty (manager-pinned) reads
   placement: manager
+  workload: node-local
   modes:
     host:
       enabled: true