feat: remaining phases — actuator provisioning, transition checks, cleanup

Phase 2: Actuator provisioning
- ProvisionLXC: pct create, start, package install, mounts, health check
- ProvisionVM: qm create, status check via SSH
- sshExecSimple helper for lightweight SSH command execution
- resolveHost helper for entity attribute lookups

Phase 5: Transition check enforcement
- TransitionChecks map with 8 named checks:
  age-key-enrolled, mesh-joined, health-check-answering,
  no-inbound-edges, secrets-revoked, backups-verified,
  ingress-dns-removed, doc-page-complete
- All checks accept pool + entity attrs for validation at transition time

Phase 6: Cleanup
- tools/setup-caveman.sh — npm install + wrapper + templates
- tools/setup-hermes-soul.sh — SOUL.md provisioning
- CLIENTS.md updated for thin client model (no git clone, API-based)
- Old git-sync references replaced with context poller

All tests pass, go vet clean.

tools/setup-hermes-soul.sh

@@ -1,68 +1,14 @@
 #!/usr/bin/env bash
-# setup-hermes-soul.sh — auto-provisions Hermes SOUL.md from canonical HERMES.md.
-# Runs automatically after every homelab-context git pull (via tools/post-pull.sh).
-#
-# What it does:
-#   - Detects if Hermes Agent is installed (~/.hermes/SOUL.md exists)
-#   - If yes, copies the canonical HERMES.md content into SOUL.md with
-#     an auto-generated header that declares /opt/homelab-context as source of truth
-#   - Idempotent — re-running re-copies if HERMES.md content changed
-#
-# For non-Hermes agents (Goose, Claude Code, etc.), this script is a no-op.
-# Those agents use the `.goosehints` symlink mechanism instead.
-
+# setup-hermes-soul.sh — provision Hermes agent persona.
+# Copies ~/.hermes/SOUL.md from hermes/SOUL.md. No-op on non-Hermes agents.
 set -euo pipefail
 
-CONTEXT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-HERMES_MD="$CONTEXT_DIR/.agents/HERMES.md"
-SOUL_MD="${HOME}/.hermes/SOUL.md"
+CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
 
-# Colors for output (only when connected to a terminal)
-if [ -t 1 ]; then
-  GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+if [ -f "$CLONE_DIR/hermes/SOUL.md" ]; then
+    mkdir -p "$HOME/.hermes"
+    cp "$CLONE_DIR/hermes/SOUL.md" "$HOME/.hermes/SOUL.md"
+    echo "[setup-hermes-soul] SOUL.md provisioned"
 else
-  GREEN=''; YELLOW=''; NC=''
-fi
-ok()   { echo -e "${GREEN}[hermes-soul]${NC} $1"; }
-skip() { echo -e "${YELLOW}[hermes-soul]${NC} $1"; }
-
-# --- 1. Check if Hermes is installed ---
-if [ ! -f "$SOUL_MD" ]; then
-  skip "hermes not installed (~/.hermes/SOUL.md not found) — skipping"
-  exit 0
-fi
-
-# --- 2. Check if canonical HERMES.md exists ---
-if [ ! -f "$HERMES_MD" ]; then
-  echo "[hermes-soul] WARNING: $HERMES_MD not found — skipping"
-  exit 0
-fi
-
-# --- 3. Write SOUL.md with canon source header + HERMES.md content ---
-{
-  echo "# Hermes Agent Persona — homelab agent (${HOSTNAME:-$(hostname -s 2>/dev/null || echo 'unknown')})"
-  echo ""
-  echo "You are an AI agent running in the **hubris** homelab."
-  echo ""
-  cat << 'PRE'
-## Source of truth
-
-The homelab-context repo at `/opt/homelab-context/` is the single source of truth for:
-- Fleet topology (`inventory.yaml`, `inventory.yaml`)
-- Service endpoints and credentials
-- Agent behaviour and conventions
-
-This SOUL.md is auto-generated from `/opt/homelab-context/HERMES.md` by
-`tools/setup-hermes-soul.sh`. Do not edit SOUL.md directly — edit HERMES.md
-in the homelab-context repo instead. Changes propagate automatically on the
-next sync or by running:
-
-    sudo homelab sync
-
----
-
-PRE
-  cat "$HERMES_MD"
-} > "$SOUL_MD"
-
-ok "SOUL.md provisioned from HERMES.md ($(wc -l < "$SOUL_MD") lines)"
+    echo "[setup-hermes-soul] no hermes/SOUL.md found; skipping"
+fi