docs(solaria): note verified docker gid 996; recon appendix on undeployed fix

The group_add fix itself already landed on master (ddae57c) but the running
container still has GroupAdd=[999] — deploy pending from main checkout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/architecture/RECON-multiagent-2026-07-27.md

@@ -637,3 +637,13 @@ No runtime state was touched.
 - `outline`, `joplin`, `umami` run on vps with no `services/<name>` dir on
   master — their hosts entries added in etap 0 document this; actual GitOps
   cutover (compose in repo) is still pending (F20.2).
+
+**Solaria node-agent docker gid (A2/E19) — status 2026-07-30**
+
+- Repo fix already on master (`ddae57c`, `group_add: "996"` in
+  `hosts/solaria/runtime/node-agent/docker-compose.override.yml`) but never
+  deployed: running container inspected 2026-07-30 shows `GroupAdd=[999]` and
+  still logs `Docker unavailable: Permission denied`. Deploy from the task
+  worktree is blocked by design (`deploy.sh` preflight enforces master);
+  pending operator run of `scripts/deploy/deploy.sh solaria` from the main
+  checkout, then re-verify container events reach `/opt/homelab/events/` on vps.

hosts/solaria/runtime/node-agent/docker-compose.override.yml

@@ -7,7 +7,7 @@ services:
     # group_add lists, so the base 999 stays alongside; 996 is what grants
     # socket access here. Same per-host pattern as piha (123) and lustro (991).
     group_add:
-      - "996"
+      - "996"  # host docker gid, verified 2026-07-30 (getent group docker → 996)
     environment:
       - NODE_NAME=solaria
       - NODE_TYPE=ai_node