feat: decommission nomos agent runtime (plan §5)

Replace nomos with dsh (DeepSeek Harness) as the agent runtime per
plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5.

Deleted:
- cmd/nomos/ (agent loop, :8092 chat gateway, task tools, eval runner)
- nomos/ (SOUL.md, config.yaml, skills/)
- internal/nomos/{session,messagequeue,retrycap,turngate,assent}/
- compose/nomos/ Dockerfile + docker-compose nomos service
- httpapi /agent reverse-proxy mount (NOMOS_PROXY_URL)
- evals/*.yaml (nomos golden-conversation manifests)
- compose/caddy/Caddyfile.oikos nomos.hubris.network block + /agent path
- .golangci.yml nomos-isolation rules
- go.mod openai-go dependency (go mod tidy)

Kept:
- internal/adapters/postgres assent-window logic (governance port)
- OIKOS_NOMOS_AGENT_SLUG config (MCP agent entity attribution)
- Full REST API, MCP tools, policy, scheduler, secrets

Cleaned: deploy.sh image prune, verify-phase6.sh checks,
seed-secrets.sh key source, README/CONTRIBUTING/AGENTS.md docs.

Build, vet, test, compose config all pass.

compose/caddy/Caddyfile.oikos

@@ -3,10 +3,9 @@
 # Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
 # IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
 #
-# The SPA is no longer embedded in the oikos binary; it's built and served
-# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
-# service, mac-mini:8091) rather than as static files read off local disk —
-# see that service's comment for why. Every API/MCP/agent route now requires
+# The SPA lives in its own repo (dtoro/oikos-web) and deploys as its own
+# compose project publishing mac-mini:8091 — see the docker-compose.yml
+# comment. Every API/MCP route requires
 # a bearer token in all cases (api's dev-open bypass was removed) —
 # non-browser clients (Wails, curl, a future mobile client) can't complete
 # Authentik's browser-session login, so those routes bypass `import
@@ -26,11 +25,10 @@ oikos.hubris.network {
         reverse_proxy 192.168.178.182:8090
     }
     # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
-    # is the real gate for all three; Authentik would just reject non-browser
-    # callers before they ever get there. /agent/* now goes through api's own
-    # (auth'd) proxy mount rather than straight to nomos:8092, so it's
-    # covered by the same check as /api/v1/* and /mcp.
-    @api path /api/v1/* /mcp /agent/*
+    # is the real gate; Authentik would just reject non-browser callers
+    # before they ever get there, so /api/v1/* and /mcp bypass `import
+    # authentik` and rely on api's own combinedAuth.
+    @api path /api/v1/* /mcp
     handle @api {
         reverse_proxy 192.168.178.182:8090
     }
@@ -50,10 +48,7 @@ mcp.hubris.network {
     reverse_proxy 192.168.178.182:8090
 }
 
-# Nomos's own gateway (workstation access) — still has NO auth of its own
-# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
-# can reach this host can talk to nomos directly, bypassing api entirely.
-# Not fixed by the client/server split — tracked separately.
-nomos.hubris.network {
-    reverse_proxy 192.168.178.182:8092
-}
+# nomos.hubris.network (the retired nomos gateway, :8092) was removed with
+# the nomos decommission — plans/2026-08-16-dsh-as-agent-replace-nomos.md
+# section 5. The agent runtime is dsh (external MCP client, no inbound
+# gateway). Remember to mirror this removal in dtoro/caddy-conf.