chore: purge stale files, worktrees, and merged branches

Problem: the repo carried cruft that predates the Phase 1 client split:
tracked web/node_modules and web/dist content (committed before the
ignore rules existed — ~2.6M lines), seven stale Claude worktrees plus
two stale Agent Manager worktrees (1.5GB on disk, all fully merged),
their 29 merged experiment branches, a pre-DB root inventory.yaml,
Playwright MCP session logs, a config screenshot, and the executed
one-shot apps/105 webhook-cleanup script. The dockerignore's own
comment documents how this cruft once starved the mac-mini disk
mid-build.

Change:
- git rm: web/ + cmd/desktop/ tracked remnants (node_modules, dist),
  root inventory.yaml (stale pre-DB copy; seeds/inventory.yaml is
  authoritative and what tests read), .playwright-mcp/ logs,
  config-screen.png, .claude/launch.json,
  scripts/cleanup-apps105-webhooks.sh (job done; pattern lives on in
  oikos-web's webhook setup).
- Removed 9 stale worktrees (nested-first) + pruned; deleted 29 fully
  merged branches (claude/*, feature/*, frontend-os-apps,
  judicious-freckle, code-quality-* pair, impartial-height). The one
  branch with an unmerged commit, chore/vendor-orby-engine, vendored
  web/vendor — that work moved to dtoro/oikos-web in Phase 1, so it is
  superseded.
- Disk cleanup: web/, cmd/desktop/, stray desktop binary, bin/, build
  artifacts. Kept: root oikos + webhook binaries (referenced by the
  launchd deploy unit and oikos-web's installer), .env bootstrap,
  .infisical-credentials.
- .gitignore: .claude/, .playwright-mcp/, config-screen.png now
  clone-safe instead of relying on local info/exclude.

Risk: none functional — deletions are either merged history (branches
recoverable from reflog) or content that moved repos; build, vet,
tests, and generate-check all green post-purge.

Verification: go build/vet, make test (19 pkgs ok), generate-check,
git ls-files web cmd/desktop → 0; worktree list → main only.

scripts/cleanup-apps105-webhooks.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-# Remove apps/105 Gitea webhooks from the oikos repo.
-# apps/105 is stopped; its deploy webhook (ids 10, 11) should be removed
-# so pushes no longer trigger deploys to the old Python stack.
-#
-# Usage:
-#   GITEA_TOKEN="<your-token>" ./scripts/cleanup-apps105-webhooks.sh
-#
-# Get a token: git.hubris.network → Settings → Applications → Generate Token
-# Scopes needed: write:repository
-
-set -euo pipefail
-
-GITEA_URL="${GITEA_URL:-https://git.hubris.network}"
-REPO="${REPO:-dtoro/oikos}"
-TOKEN="${GITEA_TOKEN:-}"
-
-if [ -z "$TOKEN" ]; then
-    echo "ERROR: GITEA_TOKEN not set"
-    echo "Usage: GITEA_TOKEN='...' $0"
-    exit 1
-fi
-
-echo "=== Listing webhooks for $REPO ==="
-HOOKS=$(curl -s -H "Authorization: token $TOKEN" \
-    "$GITEA_URL/api/v1/repos/$REPO/hooks")
-
-echo "$HOOKS" | jq -r '.[] | "  id=\(.id) url=\(.config.url) active=\(.active)"'
-
-# Find hooks pointing to apps/105
-APPS105_HOOKS=$(echo "$HOOKS" | jq -r '.[] | select(.config.url | test("apps105|192.168.8.105")) | .id')
-
-if [ -z "$APPS105_HOOKS" ]; then
-    echo ""
-    echo "No apps/105 webhooks found. Nothing to do."
-    exit 0
-fi
-
-echo ""
-echo "=== Found apps/105 webhooks ==="
-for id in $APPS105_HOOKS; do
-    URL=$(echo "$HOOKS" | jq -r ".[] | select(.id == $id) | .config.url")
-    echo "  Hook $id → $URL"
-done
-
-echo ""
-read -p "Delete these webhooks? [y/N] " CONFIRM
-
-if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then
-    echo "Aborted."
-    exit 0
-fi
-
-for id in $APPS105_HOOKS; do
-    echo "Deleting hook $id..."
-    RESP=$(curl -s -w "%{http_code}" -o /dev/null \
-        -X DELETE \
-        -H "Authorization: token $TOKEN" \
-        "$GITEA_URL/api/v1/repos/$REPO/hooks/$id")
-    if [ "$RESP" = "204" ]; then
-        echo "  ✓ Hook $id deleted"
-    else
-        echo "  ✗ Hook $id: HTTP $RESP"
-    fi
-done
-
-echo ""
-echo "=== Done ==="