port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

hosts/strong.yaml

@@ -1,32 +1,24 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: strong
+# Generated by oikos build-hosts from inventory.yaml.
+# Do NOT edit by hand.
+
+age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
 kind: proxmox-host
+lan_ip: 192.168.178.181
+mcp_endpoint: https://mcp.hubris.network/mcp
+mesh_globals:
+  accepted:
+    - netbird
+    - tailscale
+  primary: netbird
+name: strong
+notes:
+  - Reformatted from Linux workstation ("ludo-mini" in this wiki, still the machine's nickname) to Proxmox VE 9.2.3 on 2026-07-01. Renamed the inventory/wiki identity from ludo-mini to strong on the same day so it matches the OS/cluster hostname everywhere (bootstrap looks up hosts/$(hostname).yaml, so a mismatch would break enrollment).
+  - Joined hubris's "Homelab" cluster same day. 2-node, no QDevice tiebreaker yet — see hosts/hubris.md quorum note.
+  - Netbird not yet installed (fresh OS wiped prior enrollment); reachable today only via the household LAN / existing Fritz static route to 192.168.8.0/24. Re-enroll in mesh as a follow-up if off-LAN access to this host itself (not just its future guests) is needed.
+  - First step of the planned library-SSD migration — see .hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md (filename kept as-is, it's a historical planning doc). Only Phase 1 (Proxmox install + cluster join) is done; no physical drive move, service migration, or GPU passthrough has happened yet.
 os: linux
 role: hypervisor
-state: active
-lan_ip: 192.168.178.181
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
 ssh:
   user: root
-notes:
-- Reformatted from Linux workstation ("ludo-mini" in this wiki, still the machine's nickname) to Proxmox
-  VE 9.2.3 on 2026-07-01. Renamed the inventory/wiki identity from ludo-mini to strong on the same day
-  so it matches the OS/cluster hostname everywhere (bootstrap looks up hosts/$(hostname).yaml, so a mismatch
-  would break enrollment).
-- "Joined hubris's \"Homelab\" cluster same day. 2-node, no QDevice tiebreaker yet \u2014 see hosts/hubris.md\
-  \ quorum note."
-- Netbird not yet installed (fresh OS wiped prior enrollment); reachable today only via the household
-  LAN / existing Fritz static route to 192.168.8.0/24. Re-enroll in mesh as a follow-up if off-LAN access
-  to this host itself (not just its future guests) is needed.
-- "First step of the planned library-SSD migration \u2014 see .hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md\
-  \ (filename kept as-is, it's a historical planning doc). Only Phase 1 (Proxmox install + cluster join)\
-  \ is done; no physical drive move, service migration, or GPU passthrough has happened yet."
-age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active