Town: Pleroma joins, and a rerun finds what it made

Pleroma 2.10.2 runs in the pasture from its OTP release (libvips, the
dedupe question, and hackney pointed at the system CA bundle); its driver is
Akkoma's on its own container and database. The pair passes 241 cells, after
its first run showed Pleroma dropping Follows it could not verify yet.

The PrivaPub driver finds the group an earlier run made instead of failing
on the name; the seeder posts a quote or reply of a post from its own round
after that post.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -494,6 +494,10 @@ tools/pasture/run.sh down                                            # removes e
 - **Hollo (0.9.19):** Fedify's microblog server on the shared Postgres, set up through its web form (which
   checks `Origin` against `Host`, so the request names `hollo.test` without the port). It needs a 44-character
   `SECRET_KEY`, a media directory and a `themeColor`; statuses and votes go as JSON. Town only, no scenario.
+- **Pleroma (2.10.2):** `images/pleroma` installs the OTP release, pinned by checksum, as Akkoma's does; it also needs
+  libvips, and `instance gen` asks about deduplicating uploads. Its federation runs on hackney, which trusts only
+  certifi's compiled-in roots, so the entrypoint points `:pleroma, :http, adapter` at the system CA bundle. It answers
+  an inbox POST at once and verifies in a worker (`oban_jobs` shows what it refused and why). Town only, no scenario.
 - **Iceshrimp.NET (2026.1.2-beta):** on the shared Postgres with AuthorizedFetch on and open registrations, trusting
   Caddy's CA through `SSL_CERT_FILE`. Accounts come from its own `/api/iceshrimp/auth/register` (its login cuts the
   connection short for a name it does not know), Mastodon API tokens from its OAuth form, which prints the out-of-band