0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/actuator/ssh.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
-	"os"
 	"strings"
 	"sync"
 	"time"
@@ -131,37 +130,19 @@ func ExecuteProcedure(
 	start := time.Now()
 
 	// Parse the SSH key
-	key, err := os.ReadFile(cfg.KeyPath)
+	signer, err := LoadSigner(cfg.KeyPath)
 	if err != nil {
 		return SSHResult{
-			Err:      fmt.Errorf("read ssh key: %w", err),
+			Err:      err,
 			Duration: time.Since(start),
 			Verified: false,
 		}
 	}
 
-	signer, err := ssh.ParsePrivateKey(key)
-	if err != nil {
-		return SSHResult{
-			Err:      fmt.Errorf("parse ssh key: %w", err),
-			Duration: time.Since(start),
-			Verified: false,
-		}
-	}
-
-	addr := net.JoinHostPort(cfg.Host, fmt.Sprintf("%d", cfg.Port))
-	if cfg.Port == 0 {
-		addr = net.JoinHostPort(cfg.Host, "22")
-	}
-
-	clientCfg := &ssh.ClientConfig{
-		User:            cfg.User,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: HostKeyCallback(),
-		Timeout:         cfg.Timeout,
-	}
-
-	client, err := ssh.Dial("tcp", addr, clientCfg)
+	client, err := Dial(ctx, DialOptions{
+		Host: cfg.Host, Port: cfg.Port, User: cfg.User,
+		Signer: signer, Timeout: cfg.Timeout,
+	})
 	if err != nil {
 		class := classifySSHError(err)
 		return SSHResult{
@@ -229,38 +210,11 @@ func ExecuteProcedure(
 	}
 }
 
-// runSSHCommand executes a single command over an established SSH session.
-// Uses context-aware goroutines: ctx.Done() closes the session.
+// runSSHCommand executes a single command over an established SSH session via
+// the shared RunCombinedOutput primitive (context-aware abort + combined output).
 func runSSHCommand(ctx context.Context, client *ssh.Client, command string) (string, error) {
-	session, err := client.NewSession()
-	if err != nil {
-		return "", fmt.Errorf("create session: %w", err)
-	}
-	defer session.Close()
-
-	// Wrap in goroutine so we can abort on ctx.Done()
-	type result struct {
-		output string
-		err    error
-	}
-
-	ch := make(chan result, 1)
-	go func() {
-		out, err := session.CombinedOutput(command)
-		ch <- result{output: string(out), err: err}
-	}()
-
-	select {
-	case <-ctx.Done():
-		// Close the session to abort the SSH command
-		session.Close()
-		return "", ctx.Err()
-	case res := <-ch:
-		if res.err != nil {
-			return res.output, fmt.Errorf("command: %w", res.err)
-		}
-		return res.output, nil
-	}
+	out, err := RunCombinedOutput(ctx, client, command)
+	return string(out), err
 }
 
 // ─── Procedure parsing ────────────────────────────────────────────────────