feat: render qt/ at deploy time and enforce the suffix (step 4)

qt/ was declared a render path in step 1 but nothing rendered it: the Qt
deploy step was a plain rsync, so the UI files shipped with literal
placeholders in every PV name.

  * deploy.yml renders the deployed qt/ directory with render_subs.py
    after the rsync. No --service is needed; qt holds no per-service
    token, and a file that acquired one would fail the step rather than
    ship the placeholder.
  * bin/sls_hla_launch_gui.sh no longer passes an AGEBD_ENV_SUFFIX macro.
    No .ui file has referenced $(AGEBD_ENV_SUFFIX) since a06fded, and the
    suffix is now baked in at deploy time. This removes the last
    hardcoded '-DEV' outside config/environments.yml.

check_ui_files.py is rewritten for the chosen convention. It asserted the
old caQtDM macro, and its regex had stopped matching anything at all once
placeholders appeared in device names -- against the pre-fix Service
Manager it inspected 0 names, where the new check finds 16 violations.
The new rule: every AGEBD- device name carries the suffix token, except
systemd unit names, which are the same in both environments. The token
name is read from the central config so a rename cannot leave this check
enforcing a stale one.

Fixing what that check surfaced, all in A_BD_ServiceManager.ui:

  * 16 'IOC=AGEBD-CPCL-<NAME>' caInclude macro values had no suffix. The
    included UI uses them as PV prefixes ($(IOC):STATUS, $(IOC):RESTART),
    so the dev Service Manager was reading status from, and sending
    restarts to, production IOCs.
  * Two ssh commands hardcoded sls-vserv-bd-hla01, so the dev GUI's
    restart button targeted the production HLA host.
  * cli generates those macro values, so the generator emits the token
    too and new services are no longer born with the bug.

These were latent while qt/ shipped unrendered placeholders; turning
rendering on would have made them live.

Verified: dev renders -DEV device names and the -dev host, prod renders
byte-identical to the currently deployed prod files, no placeholder
survives in either, and all 24 UI files stay well-formed XML.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bin/sls_hla_launch_gui.sh

@@ -4,12 +4,13 @@ UI_FILENAME=$1
 AGEBD_ENV=$2  # 'dev' for dev environment, any other string launches prod.
 REMAINING_ARGS=( "${@:3}" )
 
+# The environment suffix is baked into the UI files when qt/ is rendered at
+# deploy time, from config/environments.yml. Launching from
+# /sls/bd/hla/${AGEBD_ENV}/qt therefore already targets the right devices, so
+# no AGEBD_ENV_SUFFIX macro is passed here.
 if [ "$AGEBD_ENV" = "dev" ]; then
-    AGEBD_ENV_SUFFIX="-DEV"
     EPICS_CA_ADDR_LIST="$EPICS_CA_ADDR_LIST 129.129.146.255"
-else
-    AGEBD_ENV_SUFFIX=""
 fi
 
 export EPICS_CA_ADDR_LIST
-caqtdm -macro "AGEBD_ENV_SUFFIX=${AGEBD_ENV_SUFFIX}" "${REMAINING_ARGS[@]}" "${UI_FILENAME}" 
+caqtdm "${REMAINING_ARGS[@]}" "${UI_FILENAME}"