db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

archive/knowledge/containers/119-sophia.md

@@ -0,0 +1,23 @@
+# 119 — `sophia`
+
+Single-container workload "sophia". Reads/writes under `/mnt/library/sophia`.
+
+## At a glance
+- **Hostname:** `sophia`
+- **IP:** `192.168.8.157`
+- **Privilege:** privileged
+- **Resources:** 2 cores / 1 GiB RAM / 10 GiB rootfs
+- **Mounts:** `/mnt/library` ↔ `/mnt/library`
+- **Public hostname:** none
+
+## Permissions
+LXC has `www-data` in the [media GID 10000 group](../infrastructure/media-permissions.md). The `/mnt/library/sophia` subtree itself is single-container and not on the setgid shared group.
+
+## Related
+- [Hubris host](../hosts/hubris.md)
+- [Media permissions](../infrastructure/media-permissions.md)
+
+## Changelog
+
+### 2026-04-28 — wiki entry created
+Stub. Document what runs inside next time we work on this LXC.