0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/actuator/actuator.go

@@ -17,7 +17,6 @@ import (
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/db/sqlcgen"
 	"github.com/google/uuid"
-	"golang.org/x/crypto/ssh"
 )
 
 // Run starts the actuator loop. Blocks until ctx is cancelled.
@@ -403,7 +402,7 @@ func ProvisionVM(ctx context.Context, pool *db.Pool, entityID uuid.UUID, attrs m
 	return nil
 }
 
-// sshExecSimple runs a command over SSH with a simple client setup.
+// sshExecSimple runs a command over SSH using the shared dial/run primitives.
 // Uses the default SSH key from SSH_KEY_PATH or ~/.ssh/id_rsa.
 func sshExecSimple(ctx context.Context, host, user, command string) (string, error) {
 	keyPath := os.Getenv("SSH_KEY_PATH")
@@ -411,55 +410,19 @@ func sshExecSimple(ctx context.Context, host, user, command string) (string, err
 		keyPath = os.Getenv("HOME") + "/.ssh/id_rsa"
 	}
 
-	keyBytes, err := os.ReadFile(keyPath)
+	signer, err := LoadSigner(keyPath)
 	if err != nil {
-		return "", fmt.Errorf("read ssh key: %w", err)
+		return "", err
 	}
 
-	signer, err := ssh.ParsePrivateKey(keyBytes)
+	client, err := Dial(ctx, DialOptions{Host: host, User: user, Signer: signer})
 	if err != nil {
-		return "", fmt.Errorf("parse ssh key: %w", err)
-	}
-
-	clientCfg := &ssh.ClientConfig{
-		User:            user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: HostKeyCallback(),
-		Timeout:         10 * time.Second,
-	}
-
-	client, err := ssh.Dial("tcp", host+":22", clientCfg)
-	if err != nil {
-		return "", fmt.Errorf("ssh dial %s: %w", host, err)
+		return "", err
 	}
 	defer client.Close()
 
-	session, err := client.NewSession()
-	if err != nil {
-		return "", fmt.Errorf("create session: %w", err)
-	}
-	defer session.Close()
-
-	type result struct {
-		output string
-		err    error
-	}
-	ch := make(chan result, 1)
-	go func() {
-		out, e := session.CombinedOutput(command)
-		ch <- result{output: string(out), err: e}
-	}()
-
-	select {
-	case <-ctx.Done():
-		session.Close()
-		return "", ctx.Err()
-	case res := <-ch:
-		if res.err != nil {
-			return res.output, res.err
-		}
-		return res.output, nil
-	}
+	out, err := RunCombinedOutput(ctx, client, command)
+	return string(out), err
 }
 
 // resolveHost resolves a host entity slug to (address, user) for SSH.