fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/chrome-service/files/novnc/Dockerfile

@@ -0,0 +1,19 @@
+FROM docker.io/library/ubuntu:24.04
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      x11vnc \
+      novnc \
+      websockify \
+      ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# noVNC ships /usr/share/novnc/vnc.html; alias to index.html so / works.
+RUN ln -sf /usr/share/novnc/vnc.html /usr/share/novnc/index.html
+
+EXPOSE 6080
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+CMD ["/entrypoint.sh"]

stacks/chrome-service/files/novnc/entrypoint.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Connect to the chrome-service container's Xvfb (shared pod network, TCP)
+# and serve the noVNC HTML5 client + websockify bridge on :6080.
+set -e
+
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+  if echo > /dev/tcp/127.0.0.1/6099 2>/dev/null; then
+    echo "Xvfb TCP up after attempt $i"
+    break
+  fi
+  echo "waiting for Xvfb TCP 6099 attempt=$i"
+  sleep 2
+done
+
+# websockify runs as PID 1; x11vnc is a child so its logs land on container stdout
+# `-noshm` skips MIT-SHM probes that fail across container boundaries (each
+# container has its own /dev/shm); `-noxdamage` skips XDAMAGE which Xvfb
+# doesn't expose; `-quiet` keeps the polling chatter out of pod logs.
+echo "starting x11vnc -> :5900"
+x11vnc -display localhost:99 -nopw -listen 0.0.0.0 -rfbport 5900 \
+       -forever -shared -noshm -noxdamage -quiet 2>&1 &
+X11VNC_PID=$!
+
+for i in 1 2 3 4 5 6 7 8 9 10; do
+  if echo > /dev/tcp/127.0.0.1/5900 2>/dev/null; then
+    echo "x11vnc bound 5900 after attempt $i"
+    break
+  fi
+  echo "waiting for x11vnc :5900 attempt=$i"
+  sleep 2
+done
+
+if ! echo > /dev/tcp/127.0.0.1/5900 2>/dev/null; then
+  echo "ERROR: x11vnc did not bind 5900"
+  exit 1
+fi
+
+echo "starting websockify -> :6080"
+exec websockify --web=/usr/share/novnc 6080 localhost:5900