Phase 1: cross-client homelab context + MCP scaffolding

Add the foundation for distributing homelab context to every client
(LXCs, VMs, workstations including republic-laptop, mac-mini, ludo-mini)
with a single source of truth, structured query layer (MCP), and per-client
age-key issuance for secrets:

- inventory.yaml — canonical topology (hosts, services, mesh addresses)
- hosts/*.yaml — per-host identity files generated from inventory by
  mcp/build_host_files.py; do not edit by hand
- AGENTS.md — orientation doc symlinked to /root/AGENTS.md on every client
- bootstrap.sh — one-shot enroll (Linux + macOS), clones repo, fetches age
  key from issuance, installs sync timer/launchd job, drops the homelab CLI
- bin/homelab — single-binary Python CLI: whoami, list, ssh, pct, logs,
  restart, open, status, secret, sync, mcp, client add/remove, nuke
- mcp/server.py — FastMCP server: context tools + read-only management
  tools (no mutations exposed); shell-outs use mcp-reader restricted ssh key
- mcp/deploy/ — claudio-monitor-style gitea webhook deploy scaffold for the
  MCP service on LXC 105 (ports 9810 mcp, 9811 webhook)
- secrets-issuance/ — per-client age key auto-provisioning over the mesh;
  source-IP gated against inventory, with denylist for revoked clients
  (ports 9820 issue, 9821 webhook)
- secrets/, .sops.yaml — SOPS recipient scaffolding; the operator fills in
  age public keys after Phase 3a generates them
- scripts/sync/ — systemd timer (Linux) + launchd plist (macOS) pulling
  /opt/homelab-context every 5 min

Mesh: both Netbird (preferred, 100.122.0.0/16) and Tailscale accepted
during the in-flight migration; no client is gated on completing the move.

Plan reference: /root/.claude/plans/lets-make-a-plan-fluttering-trinket.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/sync/install.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Install the homelab-context sync mechanism for the current OS.
+# Called by bootstrap.sh; safe to re-run (idempotent).
+
+set -euo pipefail
+
+REPO_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab-context}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+case "$(uname -s)" in
+    Linux)
+        install -m 0644 "$SCRIPT_DIR/linux/homelab-context-sync.service" \
+            /etc/systemd/system/homelab-context-sync.service
+        install -m 0644 "$SCRIPT_DIR/linux/homelab-context-sync.timer" \
+            /etc/systemd/system/homelab-context-sync.timer
+        systemctl daemon-reload
+        systemctl enable --now homelab-context-sync.timer
+        # Kick once so the first pull happens immediately.
+        systemctl start homelab-context-sync.service || true
+        echo "[install.sh] linux: timer installed and started"
+        ;;
+    Darwin)
+        PLIST=/Library/LaunchDaemons/network.hubris.homelab-context-sync.plist
+        install -m 0644 -o root -g wheel \
+            "$SCRIPT_DIR/macos/network.hubris.homelab-context-sync.plist" "$PLIST"
+        # Touch the log path so the daemon can write without a TOCTOU.
+        touch /var/log/homelab-context-sync.log
+        chmod 0644 /var/log/homelab-context-sync.log
+        # bootstrap may have loaded a previous version; reload.
+        launchctl bootout system "$PLIST" 2>/dev/null || true
+        launchctl bootstrap system "$PLIST"
+        launchctl enable system/network.hubris.homelab-context-sync
+        # Kick once.
+        launchctl kickstart -k system/network.hubris.homelab-context-sync || true
+        echo "[install.sh] macos: launchd job loaded and kicked"
+        ;;
+    *)
+        echo "[install.sh] unsupported OS: $(uname -s)" >&2
+        exit 1
+        ;;
+esac

scripts/sync/linux/homelab-context-sync.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Pull /opt/homelab-context from Gitea
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/git -C /opt/homelab-context pull --ff-only --quiet
+TimeoutStartSec=60
+# Don't fail aggressively — a missed pull just retries next tick.
+SuccessExitStatus=0 1
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

scripts/sync/linux/homelab-context-sync.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodic pull of /opt/homelab-context
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Unit=homelab-context-sync.service
+
+[Install]
+WantedBy=timers.target

scripts/sync/macos/network.hubris.homelab-context-sync.plist

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>network.hubris.homelab-context-sync</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/bin/git</string>
+        <string>-C</string>
+        <string>/opt/homelab-context</string>
+        <string>pull</string>
+        <string>--ff-only</string>
+        <string>--quiet</string>
+    </array>
+
+    <key>StartInterval</key>
+    <integer>300</integer>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>StandardOutPath</key>
+    <string>/var/log/homelab-context-sync.log</string>
+    <key>StandardErrorPath</key>
+    <string>/var/log/homelab-context-sync.log</string>
+
+    <key>Nice</key>
+    <integer>10</integer>
+</dict>
+</plist>