0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/httpapi/actuator.go

@@ -13,12 +13,12 @@ import (
 	"sync"
 	"time"
 
+	"github.com/dtoro/oikos/internal/actuator"
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/db/sqlcgen"
 	"github.com/dtoro/oikos/internal/execlog"
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/google/uuid"
-	"golang.org/x/crypto/ssh"
 )
 
 var (
@@ -111,22 +111,14 @@ func sshExecStream(ctx context.Context, host, user, command string, sink execlog
 		user = _sshUser
 	}
 
-	addr := host + ":22"
-	signer, err := ssh.ParsePrivateKey(_sshKey)
+	signer, err := actuator.LoadSignerFromBytes(_sshKey)
 	if err != nil {
 		return "", fmt.Errorf("parse key: %w", err)
 	}
 
-	cfg := &ssh.ClientConfig{
-		User:            user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-		Timeout:         10 * time.Second,
-	}
-
-	client, err := ssh.Dial("tcp", addr, cfg)
+	client, err := actuator.Dial(ctx, actuator.DialOptions{Host: host, User: user, Signer: signer})
 	if err != nil {
-		return "", fmt.Errorf("dial %s: %w", host, err)
+		return "", err
 	}
 	defer client.Close()