feat(mcp): discover_infra_drift — live Proxmox vs DB guest reconciliation

The DB-only audit_knowledge_graph can't see guests running in Proxmox that
have no entity, or entities whose pve_id is no longer live — the drift that
the stray test LXCs were a symptom of. discover_infra_drift enumerates running
guests via pct/qm list on every proxmox host (over the same SSH/pct path the
checks use) and diffs against the DB: returns missing (live, no entity) and
ghost (DB, not live). Read-only.

Companion to audit_knowledge_graph; the skill now runs both and treats the
remaining checks (misplaced parent, undeployed scripts, seed drift) as manual.

.agents/skills/knowledge-graph-audit/SKILL.md

@@ -58,16 +58,20 @@ A `down_checks` finding that is NOT a real outage is usually one of:
 
 ## 4. What this audit does NOT cover (follow-ups)
 
-Live-infrastructure discovery is out of scope for the DB report and must be done
-manually until that machinery lands:
+Live-infrastructure discovery has its own tool — run **`discover_infra_drift`**
+alongside this one. It compares running Proxmox guests (`pct`/`qm list` on every
+proxmox host) against the DB graph and returns:
+
+- **missing entities** — a guest running in Proxmox with no DB entity.
+- **ghost entities** — a DB lxc/vm whose `pve_id` is no longer live.
+
+Still manual until that machinery lands:
 
-- **Ghost vs missing entities** — cross-check `pct list` / `qm list` (on
-  `host:hubris`, `host:strong`) and `docker ps` against `list_entities`. A guest
-  with no entity, or an entity with no guest, is drift.
 - **Misplaced parent** — compare each guest's actual Proxmox host against its
   `hosts` edge (migrations leave these stale).
 - **Undeployed scripts** — per-guest `/opt/oikos/checks/` presence.
-- **Unmodeled certs** — Caddy-managed TLS certs with no `certificate` entity.
+- **Unmodeled certs** — now modeled; verify with `audit_knowledge_graph` /
+  the cert-expiry checks.
 - **Seed drift** — run `oikos export` and `git diff seeds/` to find
   runtime-created entities not in version control.