Add a Bento service kind that deploys onto the host that runs it
bento: pin every build host to one sha before building (audit e5f48171)
bento: close the seven release-orchestration audit findings
bento: stand up bentod as a systemd user service