canbus: presence layer + departure failsafes

Water heater = occupancy truth. New Pi package campsite_presence.yaml:
rv_occupied + phones_on_campsite_wifi template sensors (wifi one stays
unavailable until the MikroTik integration lands — load-bearing for the
dead-man trigger), MQTT bridging home, a local notify-only dead-man
(heater on, no phones on WiFi 3h), and disabled pre-staged lot-light
automations for the future shed Shelly.

dsi_fault_alert.yaml gains the Octavia MQTT relay (campsite/octavia/say)
so home HA — which has no file access — can speak through the verified
webhook path.

Home-side (UI-managed, not in repo): quick failsafe (both out of the
enlarged 150m campsite zone 25 min → fans/lights off + summary ping) and
heater failsafe (2h → heater off with bridge round-trip confirmation).
Both verified live; fan states snapshot-restored after the test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

canbus/HANDOFF.md

@@ -154,6 +154,40 @@ The DSI fault is already decoded and wired in (see below) — no capture needed.
 - One transceiver = one bus-end terminator. Never add a terminated node in the
   middle of the bus (would make three terminators).
 
+## Presence & departure failsafes (2026-06-12)
+
+Occupancy truth = the **water heater switch** (always on while camping, off on
+departure). Architecture: GPS persons/zones live on home HA; the Pi computes
+occupancy + (pending) WiFi presence and bridges them home; failsafes run on
+home HA against the bridged controls; all alerts go through the Pi's Octavia
+webhook via the MQTT relay topic `campsite/octavia/say`.
+
+- `canbus/ha/campsite_presence.yaml` (Pi package): `binary_sensor.rv_occupied`
+  (heater on), `binary_sensor.phones_on_campsite_wifi` (unavailable until the
+  MikroTik step below), MQTT bridging for both, a local notify-only dead-man
+  (heater on + no phones on WiFi 3 h → Octavia), and **disabled pre-staged lot-
+  light automations** for the future shed Shelly (`switch.lot_lights`
+  placeholder — fix the entity id, remove `initial_state: false`, and reload
+  when the relay is installed; on-at-sunset is occupancy-gated, off-at-sunrise
+  unconditional).
+- Home HA (UI-managed, via API): `automation.campsite_departure_failsafe_quick`
+  (both out of zone 25 min + RV occupied → gazebo fans/lights + interior lights
+  off, Octavia + push, only pings if something was actually on) and
+  `automation.campsite_water_heater_failsafe_2h` (2 h + heater on → heater off
+  with 60 s bridge round-trip confirmation; distinct failure message if
+  unconfirmed). Both fired and verified live 2026-06-12 (fans physically cycled,
+  states restored after).
+- `zone.our_campsite` radius enlarged 50→150 m (GPS wobble safety).
+- **PENDING — MikroTik WiFi presence:** needs Chateau admin once: enable
+  `/ip service api address=192.168.69.10`, add read-only `homeassistant` user,
+  then add the `mikrotik` integration on the Pi (hub 192.168.69.1) and rename
+  the phone trackers to `device_tracker.wes_phone_wifi` /
+  `device_tracker.lindsey_iphone_wifi`. Everything downstream lights up by
+  itself (sensor availability flips on).
+- **Phone GPS checklist (manual, Wes's phone):** companion app background
+  location unrestricted, high-accuracy on, battery optimization off — his
+  tracker was >1 h stale at survey time; Lindsey's iPhone reports fine.
+
 ## DSI fault — DECODED (2026-06-12)
 
 Forced a real lockout and captured it (`captures/dsi-fault-*.log`). Already wired