feat: add prototype rc.d service + fix plan wording (Sam & Hermes)

packaging/freebsd/colibri_daemon.in: FreeBSD rc.d service file
for review only, not installed. Uses /var/db/colibri,
/var/run/colibri, COLIBRI_DB_PATH. /tmp smoke test comes first.

docs/COLIBRI-CUTOVER-PLAN.md

@@ -200,7 +200,7 @@ Lane 3 (ISO build) ───────────→ Colibri in ISO ───
 2. **Lane 1 T1.3b — FreeBSD smoke test (prototype, tear-down after).**
    - `cargo build --release` on osa, run daemon against `/tmp` paths
    - `colibri-ctl status`, `snapshot`, `spawn-local` — confirm socket + SQLite live
-   - Draft `rc.d` service file in repo (review, don't install)
+   - Draft `rc.d` service pushed for review, not installed (`packaging/freebsd/colibri_daemon.in`)
    - Smoke report in `docs/internal/sessions/` with FreeBSD version, commit, outputs
    - Tear down, iterate. This is prototype validation, not deployment.
 3. Lane 2 T2.2 (debby→domedog herdr attach) — after smoke.

packaging/freebsd/colibri_daemon.in

@@ -0,0 +1,50 @@
+#!/bin/sh
+#
+# Colibri daemon — FreeBSD rc.d service (prototype, not installed)
+#
+# This file lives in the repo for review only. Do NOT install to
+# /usr/local/etc/rc.d/ yet. The /tmp smoke test comes first.
+#
+# Usage after review:
+#   cp packaging/freebsd/colibri_daemon.in /usr/local/etc/rc.d/colibri_daemon
+#   chmod 555 /usr/local/etc/rc.d/colibri_daemon
+#   sysrc colibri_daemon_enable=NO   # keep disabled during dual-run
+#   service colibri_daemon start
+#
+# Requires:
+#   - colibri-daemon binary at /usr/local/bin/colibri-daemon
+#   - /var/db/colibri/ directory (owned by daemon user)
+#   - /var/run/colibri/ directory (owned by daemon user)
+
+# PROVIDE: colibri_daemon
+# REQUIRE: LOGIN cleanvar
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="colibri_daemon"
+rcvar="colibri_daemon_enable"
+
+command="/usr/local/bin/colibri-daemon"
+pidfile="/var/run/colibri-daemon.pid"
+
+# Run as dedicated user (create with: pw useradd colibri -d /var/db/colibri -s /sbin/nologin)
+# During prototype smoke, run as current user against /tmp paths instead.
+
+start_precmd="colibri_daemon_prestart"
+
+colibri_daemon_prestart() {
+    install -d -o colibri -g colibri -m 0750 /var/db/colibri
+    install -d -o colibri -g colibri -m 0750 /var/run/colibri
+}
+
+load_rc_config $name
+
+: ${colibri_daemon_enable:=NO}
+
+export COLIBRI_DAEMON_DATA_DIR="${colibri_daemon_data_dir:-/var/db/colibri}"
+export COLIBRI_DAEMON_SOCKET="${colibri_daemon_socket:-/var/run/colibri/colibri.sock}"
+export COLIBRI_DB_PATH="${colibri_db_path:-/var/db/colibri/colibri.sqlite}"
+export COLIBRI_HOST="${colibri_host:-$(hostname)}"
+
+run_rc_command "$1"