0.26.0 — transport-aware classifier escalation + standalone-server monitoring override

- classifyAndGate: escalate read-only commands on lxc: targets that
  touch /opt/, /etc/, /var/lib/ to config_mutation. The classifier
  scores command text only, not the SSH transport layer — SSH-ing into
  a container to read config is riskier than pct exec from the host.
- ontology: standalone-server monitoring override from inherited
  [ping, resource, updates] to [http]. VPS-like machines may not be
  SSH/ICMP-reachable from the scheduler; HTTP is the LCD liveness
  signal. Entities with full SSH can override per-entity.

seeds/ontology.yaml

@@ -241,6 +241,11 @@ entity_types:
     layer: infrastructure
     lifecycle: infrastructure
     description: Machine outside PVE management (e.g. external VPS).
+    # Override inherited [ping, resource, updates] — standalone servers may
+    # not be SSH/ICMP-reachable from the scheduler. HTTP is the least-
+    # common-denominator liveness signal. Entities with full SSH access
+    # can override to [ping, resource, http].
+    monitoring: [http]
     attributes:
       type: object
       properties: