feat: decommission nomos agent runtime (plan §5)

Replace nomos with dsh (DeepSeek Harness) as the agent runtime per
plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5.

Deleted:
- cmd/nomos/ (agent loop, :8092 chat gateway, task tools, eval runner)
- nomos/ (SOUL.md, config.yaml, skills/)
- internal/nomos/{session,messagequeue,retrycap,turngate,assent}/
- compose/nomos/ Dockerfile + docker-compose nomos service
- httpapi /agent reverse-proxy mount (NOMOS_PROXY_URL)
- evals/*.yaml (nomos golden-conversation manifests)
- compose/caddy/Caddyfile.oikos nomos.hubris.network block + /agent path
- .golangci.yml nomos-isolation rules
- go.mod openai-go dependency (go mod tidy)

Kept:
- internal/adapters/postgres assent-window logic (governance port)
- OIKOS_NOMOS_AGENT_SLUG config (MCP agent entity attribution)
- Full REST API, MCP tools, policy, scheduler, secrets

Cleaned: deploy.sh image prune, verify-phase6.sh checks,
seed-secrets.sh key source, README/CONTRIBUTING/AGENTS.md docs.

Build, vet, test, compose config all pass.

plans/2026-08-16-dsh-as-agent-replace-nomos.md

@@ -320,18 +320,23 @@ Each plugin:
 - `evals/*.yaml` — nomos golden-conversation manifests (their only runner was
   `cmd/nomos/eval`; dsh evals live at `packages/oikos/evals` in the harness
   workspace)
-- Script/doc cleanup: deploy.sh image list, verify-phase6.sh gateway checks,
-  seed-secrets.sh OpenRouter key source (host env now), README/CONTRIBUTING/
-  AGENTS.md/operator-facing comments
+- Script/doc cleanup: deploy.sh image list (+ one-time oikos-nomos image
+  prune), verify-phase6.sh gateway checks, seed-secrets.sh OpenRouter key
+  source (host env now), README/CONTRIBUTING/AGENTS.md/operator-facing
+  comments, compose/caddy/Caddyfile.oikos (`nomos.hubris.network` block and
+  `/agent/*` path removed — mirror in dtoro/caddy-conf), `.golangci.yml`
+  nomos-isolation rules, go.mod (openai-go dropped via `go mod tidy`)
 
 **Already gone before this pass:** `compose/web/` (SPA extracted to
 dtoro/oikos-web), `desktop/` (Wails wrapper, deleted with the SPA split).
 
 **Kept (per the stays list):**
-- `internal/nomos/assent/` — chat-assent/typed-confirmation parsing; the
-  assent *window* logic lives in `internal/adapters/postgres`
-  (governance.go/approvals.go) behind the governance port and is shared by
-  the dsh consent flow
+- ~~`internal/nomos/assent/`~~ — deleted after review: zero importers
+  remained once cmd/nomos was gone (the assent *window* logic lives in
+  `internal/adapters/postgres` — governance.go/approvals.go — behind the
+  governance port and is shared by the dsh consent flow; the orphaned
+  chat-text parser added nothing). `.golangci.yml` nomos rules removed with
+  it, and `go mod tidy` dropped the nomos-only openai-go dependency.
 - `internal/httpapi/` REST API, `internal/mcp/` (67+ tools),
   `internal/policy/`, `internal/scheduler/`, `internal/secrets/`
 - `OIKOS_NOMOS_AGENT_SLUG` config + compose env — resolves the seeded