docs: move narrative wiki under knowledge/wiki/ (phase 3)

Problem: node and cross-cutting narratives lived at the repo root
(containers/, vms/, infrastructure/, host .md files), interleaved with the
machine-readable substrate.

Change:
- Move containers/ -> knowledge/wiki/containers/, vms/ -> knowledge/wiki/vms/,
  infrastructure/ -> knowledge/wiki/infrastructure/, hosts/{hubris,strong}.md ->
  knowledge/wiki/hosts/, infrastructure/references/ -> knowledge/sources/references/,
  GLOSSARY.md -> knowledge/GLOSSARY.md.
- Add knowledge/{index.md,log.md,sources/index.md} scaffolding.
- Rewrite all relative links repo-wide via a path-resolving mapper (inbound +
  outbound + between-moved-files), including .hermes/, runbooks, operations,
  investigations, plans, README, AGENTS.
- Repoint inventory.yaml doc_page fields and regenerate hosts/*.yaml (which
  embed doc_page); update oikos/gen-topology.py output path, candidate doc
  paths, and footer links; update code-comment doc paths.

Substrate untouched in place: inventory.yaml, hosts/*.yaml (regenerated,
idempotent), oikos/ code, mcp/, secrets/, bin/.

Verification:
- Logical broken-link set identical to pre-move baseline (net 128 -> 127; the
  topology regen fixed one, introduced none). Remaining are pre-existing refs
  to destroyed/archived nodes, out of scope for this move.
- gen-topology.py --check exit 0 (in sync); cards carry knowledge/wiki/ doc paths.
- build_host_files.py idempotent; all inventory doc_page targets resolve.
- MCP contract verified: get_page/search_docs/get_changelog resolve moved pages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

investigations/2026-06-06-authentik-session-lifetime.md

@@ -90,9 +90,9 @@ print("session_duration:", stage.session_duration)  # → "days=30"
 
 ## Related
 
-- [Container 106 — auth-outpost](../containers/106-auth-outpost.md)
+- [Container 106 — auth-outpost](../knowledge/wiki/containers/106-auth-outpost.md)
 - [Authentik VPS migration](2026-05-31-authentik-vps-migration.md)
-- [Ingress (VPS Traefik)](../infrastructure/ingress.md)
+- [Ingress (VPS Traefik)](../knowledge/wiki/infrastructure/ingress.md)
 - `.hermes/plans/2026-06-06_232200-authentik-frequent-login-fix.md` — original plan
 
 ## Changelog

investigations/2026-06-06-caddyfile-truncation.md

@@ -55,7 +55,7 @@ This is the same class of drift as the June 5th incidents (paperless, HAOS, apps
 ## Related
 
 - [DHCP drift investigation (previous incident)](2026-06-05-homelab-dhcp-drift.md)
-- [Caddy (121)](../containers/121-caddy.md)
-- [elementsynapse (118)](../containers/118-elementsynapse.md)
+- [Caddy (121)](../knowledge/wiki/containers/121-caddy.md)
+- [elementsynapse (118)](../knowledge/wiki/containers/118-elementsynapse.md)
 - [dns-sync script](../scripts/dns-sync.py)
 - [check-caddy-backends script](../scripts/check-caddy-backends.sh)