Harden poller from Codex review: close residual storm/robustness gaps

Adversarial review (gpt-5.5) of the new architecture surfaced real gaps:

Hardware-safety / storm prevention:
- Restart-storm guard: on startup, defer the first sweep if a sweep ran
  < POLL_SWEEP_INTERVAL ago (persisted in Redis), so deploy-cycling can no
  longer trigger back-to-back full hardware sweeps (poller.py).
- Centralize pacing in the hardware gate: POLL_DRIVE_GAP is now held after
  EVERY hardware op (SMART, SES, host, MegaRAID, ledctl), not just the
  enclosure-drive loop (hwgate.py); removed the now-redundant per-loop sleeps.
- Single-instance lock made atomic (Lua compare-and-set / compare-and-expire)
  and the refresher is now fatal on any error + has a done-callback, so a
  dropped lock can never leave two pollers sweeping concurrently (store.py,
  poller.py).
- Warn loudly when POLL_CONCURRENCY > 1.

Correctness:
- Heartbeat now actually writes: cache_set omits EX when ttl<=0 (Redis
  rejects EX 0), so poller meta/last_sweep_ts persists — this also enables
  the restart-storm guard and the poller_fresh health flag (cache.py).
- Web image runs a single uvicorn worker so the MQTT publisher is a true
  singleton (two workers shared a client_id and flapped the broker) (Dockerfile).
- LED enqueue catches Redis errors -> API returns 503, not 500 (store.py).

Deploy independence:
- build.sh takes a target (web|poller|all) so web iterations never rebuild
  or repush the poller image.

Nits: drop dead SMART_CACHE_TTL constant.

services/store.py

@@ -82,11 +82,15 @@ async def get_meta() -> dict | None:
 # ── locate-LED command queue ────────────────────────────────────────────
 async def enqueue_led(device: str, state: str) -> bool:
     """API side: push a LED request for the poller to execute. Returns False
-    if Redis is unavailable (so the API can surface 503)."""
+    if Redis is unavailable or the push fails (so the API can surface 503)."""
     client = get_client()
     if client is None:
         return False
-    await client.rpush(K_LED_QUEUE, json.dumps({"device": device, "state": state}))
+    try:
+        await client.rpush(K_LED_QUEUE, json.dumps({"device": device, "state": state}))
+    except Exception as e:
+        logger.warning("LED enqueue failed: %s", e)
+        return False
     return True
 
 
@@ -105,29 +109,37 @@ async def pop_led(timeout: int = 5) -> dict | None:
         return None
 
 
-# ── poller single-instance lock ─────────────────────────────────────────
+# ── poller single-instance lock (atomic compare-and-set) ────────────────
+# Acquire if free OR already ours, refreshing the TTL — all in one round trip
+# so there's no GET/SET race that could let two pollers run concurrently.
+_ACQUIRE_LUA = (
+    "local v = redis.call('get', KEYS[1]) "
+    "if v == false or v == ARGV[1] then "
+    "  redis.call('set', KEYS[1], ARGV[1], 'EX', ARGV[2]) return 1 "
+    "else return 0 end"
+)
+# Extend only if we still own it (atomic compare-and-expire).
+_REFRESH_LUA = (
+    "if redis.call('get', KEYS[1]) == ARGV[1] then "
+    "  return redis.call('expire', KEYS[1], ARGV[2]) "
+    "else return 0 end"
+)
+
+
 async def acquire_lock(token: str, ttl: int = 30) -> bool:
-    """Try to claim the poller lock. Returns True if acquired/owned."""
+    """Atomically claim the poller lock (or re-own it). True if held."""
     client = get_client()
     if client is None:
         return True  # no Redis → no coordination possible; run anyway
-    got = await client.set(K_LOCK, token, nx=True, ex=ttl)
-    if got:
-        return True
-    current = await client.get(K_LOCK)
-    return current == token
+    return bool(await client.eval(_ACQUIRE_LUA, 1, K_LOCK, token, ttl))
 
 
 async def refresh_lock(token: str, ttl: int = 30) -> bool:
-    """Extend the lock if we still own it."""
+    """Atomically extend the lock iff we still own it."""
     client = get_client()
     if client is None:
         return True
-    current = await client.get(K_LOCK)
-    if current == token:
-        await client.expire(K_LOCK, ttl)
-        return True
-    return False
+    return bool(await client.eval(_REFRESH_LUA, 1, K_LOCK, token, ttl))
 
 
 def now() -> float: