test: e2e client lifecycle + ADRs with sequence diagrams

- client_lifecycle_test.go: full end-to-end integration test
  planned → provisioning (enroll) → active → migrating → active →
  deprecated → failed. Validates age keypair generation, attrs,
  context/secrets endpoints, invalid transition blocking, compute
  entity provisioning with relationship edges and status tracking.
  Also tests enrollment rejection for invalid states and duplicate
  slug rejection for provisioning.

- adr/0011-client-lifecycle-flows.md: workstation self-enrollment,
  compute entity provisioning, deprecation/destruction flows with
  Mermaid sequence diagrams. Full lifecycle state diagram. Transition
  check enforcement documentation.

- adr/0012-hermes-oikos-interactions.md: Hermes ↔ Oikos interaction
  flow through OODA loop phases. Thin client bootstrap. Internal
  component interactions (scheduler, actuator, notifier). Complete
  30-tool ownership matrix.

- Fix: migration 012 FK reference (executions.id → executions.entity_id)
- Fix: provision handler null attributes JSONB
- Fix: provisioning steps use entity_id for execution FK

All 3 integration tests pass, go vet clean.

internal/httpapi/impl.go

@@ -1297,6 +1297,9 @@ func (s *Server) ProvisionEntity(ctx context.Context, req gen.ProvisionEntityReq
 	if req.Body.Attributes != nil {
 		attrsJSON, _ = json.Marshal(req.Body.Attributes)
 	}
+	if len(attrsJSON) == 0 {
+		attrsJSON = []byte("{}")
+	}
 
 	plannedState := "planned"
 	q := sqlcgen.New(tx)
@@ -1336,17 +1339,21 @@ func (s *Server) ProvisionEntity(ctx context.Context, req gen.ProvisionEntityReq
 		{6, "health-check"},
 	}
 	for _, st := range steps {
-		_, _ = tx.Exec(ctx,
+		_, err = tx.Exec(ctx,
 			`INSERT INTO provisioning_steps (id, entity_id, execution_id, step_order, step_name)
-			 VALUES ($1, $2, $3, $4, $5) ON CONFLICT (entity_id, step_name) DO NOTHING`,
-			uuid.Must(uuid.NewV7()), entityID, execID, st.order, st.name)
+			 VALUES ($1, $2, $3, $4, $5)`,
+			uuid.Must(uuid.NewV7()), entityID, entityID /* executions PK is entity_id */, st.order, st.name)
+		if err != nil {
+			return nil, fmt.Errorf("insert provisioning step: %w", err)
+		}
 	}
 
-	_, _ = tx.Exec(ctx,
+	_, err = tx.Exec(ctx,
 		`INSERT INTO relationships (source_id, target_id, type)
-		 VALUES ($1, $2, 'hosts')
-		 ON CONFLICT (source_id, target_id, type, COALESCE(valid_to, 'infinity'::timestamptz))
-		 DO NOTHING`, hostID, entityID)
+		 VALUES ($1, $2, 'hosts')`, hostID, entityID)
+	if err != nil {
+		return nil, fmt.Errorf("insert relationship: %w", err)
+	}
 
 	_, actor := actorInfo(ctx)
 	_ = observability.Audit(ctx, q, "operator", actor, "provision",