port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

hosts/apps.yaml

@@ -1,62 +1,59 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: apps
-kind: lxc
-os: linux
-role: docker-apps
-state: active
+# Generated by oikos build-hosts from inventory.yaml.
+# Do NOT edit by hand.
+
+age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 host: hubris
-pve_id: 105
+kind: lxc
 lan_ip: 192.168.8.205
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
-    ip: 100.121.171.122
     fqdn: apps
+    ip: 100.121.171.122
 mesh_globals:
-  primary: netbird
   accepted:
-  - netbird
-  - tailscale
+    - netbird
+    - tailscale
+  primary: netbird
 mounts:
-- /mnt/library
-public_hosts:
-- artifacto.hubris.network
+  - /mnt/library
+name: apps
+os: linux
+pve_id: 105
+role: docker-apps
 runs:
-- artifacto
-- plantuml
-- homelab-mcp
-- secrets-issuance
-- artifacto
-- homelab_mcp
-- secrets_issuance
-services_hosted:
-- name: artifacto
-  backend: apps
-  url: https://artifacto.hubris.network
-  doc_page: knowledge/wiki/containers/105-apps.md
-  config_repo: dtoro/Artifacto
-- name: homelab_mcp
-  backend: apps
-  port: 9810
-  systemd_unit: homelab-mcp
-  public_host: mcp.hubris.network
-  endpoint: https://mcp.hubris.network/mcp
-  doc_page: knowledge/wiki/infrastructure/homelab-context.md
-  config_repo: dtoro/Homelab-Docs
-  note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via
-    Netbird (192.168.8.0/24 is a network resource routed through hubris).
-  risk_notes: "agents' primary read surface \u2014 outage degrades every agent to grepping the clone"
-- name: secrets_issuance
-  backend: apps
-  port: 9820
-  systemd_unit: secrets-issuance
-  public_host: secrets.hubris.network
-  endpoint: https://secrets.hubris.network/issue
-  doc_page: .agents/operations/agent-enrollment.md
-  config_repo: dtoro/Homelab-Docs
-  note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
-  risk_notes: "identity issuance \u2014 any change is security-sensitive; key operations are destructive-class"
-age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-mcp_endpoint: https://mcp.hubris.network/mcp
+  - artifacto
+  - plantuml
+  - homelab-mcp
+  - secrets-issuance
+  - artifacto
+  - homelab_mcp
+  - secrets_issuance
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: apps
+    config_repo: dtoro/Artifacto
+    doc_page: knowledge/wiki/containers/105-apps.md
+    name: artifacto
+    url: https://artifacto.hubris.network
+  - backend: apps
+    config_repo: dtoro/Homelab-Docs
+    doc_page: knowledge/wiki/infrastructure/homelab-context.md
+    endpoint: https://mcp.hubris.network/mcp
+    name: homelab_mcp
+    note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through hubris).
+    port: 9810
+    public_host: mcp.hubris.network
+    risk_notes: agents' primary read surface — outage degrades every agent to grepping the clone
+    systemd_unit: homelab-mcp
+  - backend: apps
+    config_repo: dtoro/Homelab-Docs
+    doc_page: .agents/operations/agent-enrollment.md
+    endpoint: https://secrets.hubris.network/issue
+    name: secrets_issuance
+    note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
+    port: 9820
+    public_host: secrets.hubris.network
+    risk_notes: identity issuance — any change is security-sensitive; key operations are destructive-class
+    systemd_unit: secrets-issuance
+state: active