feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

CONTRIBUTING.md

@@ -57,12 +57,12 @@ internal/           All Go packages
                     the phased refactor; core may not import adapters,
                     enforced by depguard (verified Phase 9 audit)
   adapters/         Ports' implementations: postgres/ (pool, migrations, seeds,
-                    sqlcgen, repos — EntityRepo, RelRepo, OntologyRepo,
-                    EntityReader, SignalRepo, MetricsRepo, etc.),
-                    ssh/ (CommandExecutor via actuator),
-                    remote/ (TargetResolver via internal/remote),
-                    probes/ (Checker implementations per probe kind:
-                    HTTP, TCP, ping, DNS, SSH)
+                    incl. knowledge seed ingest, sqlcgen, repos — EntityRepo,
+                    RelRepo, OntologyRepo, SeedRepo, EntityReader, SignalRepo,
+                    MetricsRepo, etc.), ssh/ (CommandExecutor via actuator +
+                    Provisioner for pct/qm), remote/ (TargetResolver via
+                    internal/remote), probes/ (Checker implementations per
+                    probe kind: HTTP, TCP, ping, DNS, SSH)
   httpapi/          REST server (OpenAPI-generated) — driving adapter
   mcp/              MCP tool implementations — driving adapter
   scheduler/        Observe loop, coverage sweep — driving adapter (moves
@@ -72,7 +72,6 @@ internal/           All Go packages
   remote/           Target resolution — consumed by adapters/remote
   audit/            Audit report helpers
   observability/    Event/Audit recorder helpers
-  knowledge/        Knowledge YAML seed ingestion
 api/openapi.yaml    API contract — the source of truth for endpoints
 migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML: ontology, inventory, policy, knowledge