Adding spdk loader

docs/TODO.md

@@ -663,6 +663,21 @@ must be built around **never restarting the process that holds live connections.
     artifacts from its OCI image into `./releases/<ver>/` and drives the live
     target. Rolling update = `load` new → reboot hosts → `unload` old once
     drained.
+  - **`spdk-loader.sh`** — DECLARATIVE rolling updates (the "init container that
+    stays up", compose service `spdk-loader`). On `compose up` after an
+    `IMAGE_VERSION` bump it stages + adds the new rootfs to the running target
+    ONLINE, then polls and **auto-reaps** any non-current version once it has
+    drained (0 conns) for a sustained grace window (`REAP_GRACE_SECONDS`, keep >
+    host `ctrl_loss_tmo`). So migration = bump `IMAGE_VERSION` in `.env` +
+    `docker compose up -d` (compose recreates the loader + the http/dnsmasq UKI
+    servers, but NOT the nvmeof target → no dropped connections). Single served
+    UKI ⇒ a 0-conn old version is genuinely orphaned (a returning host fetches
+    the current UKI), so auto-reap is safe; removal is still drain-gated +
+    grace-debounced. The loader + target share the RPC socket on a named volume
+    (`nvmf_tgt -r`); the loader reuses the SPDK image (has python3 + rpc.py).
+  - **No jq dependency:** `spdk-release.sh` parses RPC JSON with **python3** (the
+    SPDK image ships no jq); legacy artifacts (no per-version UUIDs in
+    verity.json) fall back to the fixed UUID pair with a warning.
   - **Per-version namespace UUIDs** (`scripts/extract-artifacts.sh`): derived
     deterministically (UUIDv5 of `image_version`), baked into the UKI cmdline +
     `verity.json` (now also carries `subnqn`); the serving side reads them back