port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

cmd/oikos/main.go

@@ -59,6 +59,11 @@ func main() {
 			slog.Error("export failed", "error", err)
 			os.Exit(1)
 		}
+	case "build-hosts":
+		if err := runBuildHosts(); err != nil {
+			slog.Error("build-hosts failed", "error", err)
+			os.Exit(1)
+		}
 	case "api":
 		if err := runAPI(ctx, cfg); err != nil {
 			slog.Error("api failed", "error", err)
@@ -111,6 +116,7 @@ Roles:
   migrate    Run database migrations (forward-only, idempotent)
   seed       Ingest seed YAML files into the database
   export     Export DB state back to seed YAMLs (DR / version control)
+  build-hosts Generate hosts/*.yaml from seeds/inventory.yaml
   api        Run the REST + MCP API server (Phase 2)
   scheduler  Run the observe + act loop (Phase 3)
   notifier   Run the notification service (Phase 3)