feat: decommission nomos agent runtime (plan §5)

Replace nomos with dsh (DeepSeek Harness) as the agent runtime per
plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5.

Deleted:
- cmd/nomos/ (agent loop, :8092 chat gateway, task tools, eval runner)
- nomos/ (SOUL.md, config.yaml, skills/)
- internal/nomos/{session,messagequeue,retrycap,turngate,assent}/
- compose/nomos/ Dockerfile + docker-compose nomos service
- httpapi /agent reverse-proxy mount (NOMOS_PROXY_URL)
- evals/*.yaml (nomos golden-conversation manifests)
- compose/caddy/Caddyfile.oikos nomos.hubris.network block + /agent path
- .golangci.yml nomos-isolation rules
- go.mod openai-go dependency (go mod tidy)

Kept:
- internal/adapters/postgres assent-window logic (governance port)
- OIKOS_NOMOS_AGENT_SLUG config (MCP agent entity attribution)
- Full REST API, MCP tools, policy, scheduler, secrets

Cleaned: deploy.sh image prune, verify-phase6.sh checks,
seed-secrets.sh key source, README/CONTRIBUTING/AGENTS.md docs.

Build, vet, test, compose config all pass.

scripts/deploy.sh

@@ -247,6 +247,13 @@ if [ -n "$OIKOS_VERSION" ]; then
     done
 fi
 
+# Decommission cleanup (nomos → dsh, plans/2026-08-16-dsh-as-agent-*
+# section 5): the oikos-nomos image is no longer built or listed above, so
+# prune every remaining tag. No-ops once they're gone.
+docker image ls -q oikos-nomos 2>/dev/null | sort -u | while read -r img; do
+    docker rmi "$img" >/dev/null 2>&1 || true
+done
+
 # ── 7. Health check wait ──────────────────────────────────────────────────
 echo "[7/8] health check"
 healthy=0