test: e2e client lifecycle + ADRs with sequence diagrams

- client_lifecycle_test.go: full end-to-end integration test
  planned → provisioning (enroll) → active → migrating → active →
  deprecated → failed. Validates age keypair generation, attrs,
  context/secrets endpoints, invalid transition blocking, compute
  entity provisioning with relationship edges and status tracking.
  Also tests enrollment rejection for invalid states and duplicate
  slug rejection for provisioning.

- adr/0011-client-lifecycle-flows.md: workstation self-enrollment,
  compute entity provisioning, deprecation/destruction flows with
  Mermaid sequence diagrams. Full lifecycle state diagram. Transition
  check enforcement documentation.

- adr/0012-hermes-oikos-interactions.md: Hermes ↔ Oikos interaction
  flow through OODA loop phases. Thin client bootstrap. Internal
  component interactions (scheduler, actuator, notifier). Complete
  30-tool ownership matrix.

- Fix: migration 012 FK reference (executions.id → executions.entity_id)
- Fix: provision handler null attributes JSONB
- Fix: provisioning steps use entity_id for execution FK

All 3 integration tests pass, go vet clean.

migrations/012_client_enrollment.up.sql

@@ -7,7 +7,7 @@
 CREATE TABLE IF NOT EXISTS provisioning_steps (
     id UUID PRIMARY KEY,
     entity_id UUID NOT NULL REFERENCES entities(id) ON DELETE CASCADE,
-    execution_id UUID NOT NULL REFERENCES executions(id) ON DELETE CASCADE,
+    execution_id UUID NOT NULL REFERENCES executions(entity_id) ON DELETE CASCADE,
     step_order INTEGER NOT NULL,
     step_name TEXT NOT NULL,
     status TEXT NOT NULL DEFAULT 'pending'