The self-swap drill is one command: it runs the four steps against a forge and prints the four dark-second figures #9009

Later: The spin-down (#7667) is not urgent by the owner's word, and a hosted child still cannot migrate connections (#8378), so the run with the owner waits.

Replaces #8940, which two builders declined: no run can reach a hosted child or have the owner present. This makes the drill something the owner starts with one line.

Done when:

• [ ] bun scripts/drills/self-swap.ts <forge-url> (token from the environment) runs docs/features/ship-itself.md's four steps: land and wait for the cut, swap and verify, a bad release that swaps back by name and holds, a restart that returns on release/good.json. After each it reads /releases and prints version, landed to live, probes and seconds dark, as one table at the end.
• [ ] It stops at the first step that does not behave and names it; it never leaves the forge on the bad release.
• [ ] A test drives it against an in-process forge with the swap keeper on (as test/release-keeper-swap.test.ts does) and asserts four figures and the swap-back.
• [ ] ship-itself.md names the command where it says the drill is not yet run.

Files: scripts/drills/self-swap.ts, test/, docs/features/ship-itself.md. Risks: the bad-release step must use a tree that fails verify by design, never a real red build.