feat: decommission nomos agent runtime (plan §5)

Replace nomos with dsh (DeepSeek Harness) as the agent runtime per
plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5.

Deleted:
- cmd/nomos/ (agent loop, :8092 chat gateway, task tools, eval runner)
- nomos/ (SOUL.md, config.yaml, skills/)
- internal/nomos/{session,messagequeue,retrycap,turngate,assent}/
- compose/nomos/ Dockerfile + docker-compose nomos service
- httpapi /agent reverse-proxy mount (NOMOS_PROXY_URL)
- evals/*.yaml (nomos golden-conversation manifests)
- compose/caddy/Caddyfile.oikos nomos.hubris.network block + /agent path
- .golangci.yml nomos-isolation rules
- go.mod openai-go dependency (go mod tidy)

Kept:
- internal/adapters/postgres assent-window logic (governance port)
- OIKOS_NOMOS_AGENT_SLUG config (MCP agent entity attribution)
- Full REST API, MCP tools, policy, scheduler, secrets

Cleaned: deploy.sh image prune, verify-phase6.sh checks,
seed-secrets.sh key source, README/CONTRIBUTING/AGENTS.md docs.

Build, vet, test, compose config all pass.

.golangci.yml

@@ -12,22 +12,18 @@ linters:
     - revive
   settings:
     depguard:
-      # ADR 0016 dependency rules. Rules only constrain files that exist:
-      # internal/core is live since Phase 0 (domain moved); internal/nomos
-      # and its bans activate in Phase 8; full audit at Phase 9.
+      # ADR 0016 dependency rules. The nomos packages (and their bans) were
+      # removed with the nomos decommission — the agent runtime is dsh, an
+      # external MCP client.
       rules:
         core-no-agent-tech:
           files:
             - "**/internal/core/**"
           deny:
-            - pkg: github.com/dtoro/oikos/internal/nomos
-              desc: core never links agent-client packages (ADR 0016 §3.1 rule 3)
-            - pkg: github.com/dtoro/oikos/internal/nomos/**
-              desc: core never links agent-client packages (ADR 0016 §3.1 rule 3)
             - pkg: github.com/openai/openai-go
-              desc: core never links the LLM SDK — nomos is an external client
+              desc: core never links the LLM SDK — the agent is an external client
             - pkg: github.com/openai/openai-go/**
-              desc: core never links the LLM SDK — nomos is an external client
+              desc: core never links the LLM SDK — the agent is an external client
             - pkg: github.com/modelcontextprotocol/go-sdk
               desc: core never links MCP packages — mcpserver is a driving adapter
             - pkg: github.com/modelcontextprotocol/go-sdk/**
@@ -44,18 +40,6 @@ linters:
               desc: core must not import composition roots
             - pkg: github.com/dtoro/oikos/cmd/**
               desc: core must not import composition roots
-        nomos-isolation:
-          files:
-            - "**/internal/nomos/**"
-          deny:
-            - pkg: github.com/dtoro/oikos/internal/core
-              desc: nomos must not import core — consume oikos via MCP/REST
-            - pkg: github.com/dtoro/oikos/internal/core/**
-              desc: nomos must not import core — consume oikos via MCP/REST
-            - pkg: github.com/dtoro/oikos/internal/adapters
-              desc: nomos must not import adapters — consume oikos via MCP/REST
-            - pkg: github.com/dtoro/oikos/internal/adapters/**
-              desc: nomos must not import adapters — consume oikos via MCP/REST
     errcheck:
       # Allow unchecked errors on common Close/Flush patterns (deferred cleanup)
       exclude-functions: