port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

hosts/teddycloud.yaml

@@ -1,42 +1,35 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: teddycloud
-kind: lxc
-os: linux
-role: teddycloud
-state: active
+# Generated by oikos build-hosts from inventory.yaml.
+# Do NOT edit by hand.
+
 host: hubris
-pve_id: 131
+kind: lxc
 lan_ip: 192.168.8.150
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-mounts:
-- /mnt/library
-public_host: teddy.hubris.network
-runs:
-- teddycloud
-services_hosted:
-- name: teddycloud
-  url: https://teddy.hubris.network
-  backend: teddycloud
-  doc_page: knowledge/wiki/containers/131-teddycloud.md
-  note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
-  risk_notes: "no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) \u2014 reachable\
-    \ to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until\
-    \ 2026-07-06 (drift-caught)"
-notes:
-- Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a self-hosted reimplementation
-  of the Toniebox cloud backend. Debian 12 (bookworm).
-- 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
-- "Predates the client-enrollment convention \u2014 undocumented in inventory.yaml until 2026-07-06, when\
-  \ Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on hubris (`pct list`) with no inventory\
-  \ entry. Static IP assigned 2026-07-05 during the strong migration (was picking up 192.168.8.243 via\
-  \ DHCP before that \u2014 see hosts/strong.md's 2026-07-05 changelog)."
-- "No age_pubkey / homelab-context enrollment \u2014 not a homelab CLI client, just a docker-compose app\
-  \ container. Not a required follow-up unless it needs secrets."
 mcp_endpoint: https://mcp.hubris.network/mcp
+mesh_globals:
+  accepted:
+    - netbird
+    - tailscale
+  primary: netbird
+mounts:
+  - /mnt/library
+name: teddycloud
+notes:
+  - Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a self-hosted reimplementation of the Toniebox cloud backend. Debian 12 (bookworm).
+  - 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
+  - Predates the client-enrollment convention — undocumented in inventory.yaml until 2026-07-06, when Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on hubris (`pct list`) with no inventory entry. Static IP assigned 2026-07-05 during the strong migration (was picking up 192.168.8.243 via DHCP before that — see hosts/strong.md's 2026-07-05 changelog).
+  - No age_pubkey / homelab-context enrollment — not a homelab CLI client, just a docker-compose app container. Not a required follow-up unless it needs secrets.
+os: linux
+public_host: teddy.hubris.network
+pve_id: 131
+role: teddycloud
+runs:
+  - teddycloud
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: teddycloud
+    doc_page: knowledge/wiki/containers/131-teddycloud.md
+    name: teddycloud
+    note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
+    risk_notes: no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) — reachable to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until 2026-07-06 (drift-caught)
+    url: https://teddy.hubris.network
+state: active