docs: add client lifecycle plan, cleanup stale files, document repo for 3 audiences

Problem: Repo had no developer guide, no client onboarding doc, no agent
dev instructions. Stale files (675KB SQL dump, one-off convert script,
legacy MCP builder) cluttered the tree. Client enrollment was a documented
intention with no Go implementation.

Changes:
- New docs: CONTRIBUTING.md (dev setup), CLIENTS.md (client onboarding),
  .agents/dev/CONTRIBUTING.md (agent codebase map)
- New plan: plans/2026-07-07-client-lifecycle-in-go.md — full client
  lifecycle (planned→provisioning→active→deprecated→destroyed) in Go,
  replacing archived Python secrets-issuance, adding client API endpoints
  and 6 missing MCP tools
- Cleanup: deleted archive/convert-wiki.py (one-off), archive/mcp/
  build_host_files.py (legacy), backups/pre-deploy-7f7d039.sql (local)
- Fixes: plans/index.md duplicate row removed, README.md repo layout
  updated for current state, AGENTS.md header points to new guides

Risk: low. Docs only + stale file deletion. No code changes. New plan is
proposal, not implementation.
Verification: git diff reviewed, all changes are prose/docs/plans.

README.md

@@ -7,6 +7,8 @@ state, classifies actions against policy, executes approved procedures over SSH,
 learns from outcomes, and escalates when uncertain.
 
 **For agents running on enrolled clients:** start with [AGENTS.md](AGENTS.md).
+**For client machines:** see [CLIENTS.md](CLIENTS.md).
+**For developers:** see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Quick start
 
@@ -101,29 +103,34 @@ oikos secret migrate  # SOPS → Infisical
 cmd/oikos/          Go entry point — single binary
 cmd/hermes/         Hermes MCP client gateway
 internal/           Go packages (httpapi, mcp, scheduler, actuator, learning,
-                    notifier, policy, secrets, db, config, ontology, domain)
+                    notifier, policy, secrets, db, config, ontology, domain,
+                    knowledge)
 api/openapi.yaml    API contract (OpenAPI 3.1)
 migrations/         Forward-only SQL migrations (TimescaleDB)
-seeds/              Bootstrap YAML (ontology, inventory, policy)
+seeds/              Bootstrap YAML (ontology, inventory, policy, knowledge)
 compose/            Dockerfiles + Caddy config
 scripts/            Deploy, watchdog, verification, rollback
 hermes/             Hermes config, persona, skills
-archive/knowledge/     Narrative documentation (containers, hosts, infrastructure)
-.agents/            Agent instruction files + skills
-plans/              Design documents
+.agents/            Agent instruction files, shared conventions, skills
+archive/            Historical reference (legacy wiki, plans, SOPS backups)
+plans/              Design documents (active + done)
+docs/adr/           Architecture decision records
 ```
 
 ## For agents
 
 See [AGENTS.md](AGENTS.md) for the full orientation. Quick reference:
 
-- **Source of truth:** DB (runtime) then repo (bootstrap + docs)
-- **Mutations:** classify against policy, request approval for `destructive`/`config_mutation`
-- **Wiki:** files under `archive/knowledge/`, changelog at bottom of each page
+- **Source of truth:** DB (runtime) then seeds (bootstrap). Old wiki is
+  archived at `archive/knowledge/` — use MCP `search_knowledge` instead.
+- **Mutations:** classify against policy, request approval for
+  `destructive`/`config_mutation`
 - **Secrets:** Infisical (primary) or SOPS (fallback) — never hardcode
 
 ## Related
 
 - [OIKOS.md](.agents/OIKOS.md) — operating model, OODA loop, ontology
+- [CLIENTS.md](CLIENTS.md) — client onboarding guide
+- [CONTRIBUTING.md](CONTRIBUTING.md) — developer guide
 - [plans/](plans/) — design documents and cutover checklist
 - [docs/adr/](docs/adr/) — architecture decision records