Oikos Week 1: kernel policy, ontology, service contract, topology gen

Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes +
approval rules for every homelab/MCP command), oikos/ontology.yaml
(8-domain systems model, typed relationships, node lifecycle), and
OIKOS.md (OODA loop operating brief, linked from AGENTS.md).

Extends inventory.yaml with a stable service contract (doc_page,
config_repo, risk_notes) on all 17 services, and a structured
archaeology: section for the 13 destroyed LXCs (was scattered
comments + a narrative table). Fixes stale drift found in the
process: authentik's backend pointed at a retired LXC (124); core
has run on the VPS since 2026-05-31.

Adds oikos/gen-topology.py, generating infrastructure/topology.md
(Mermaid compute/ingress + storage views) from inventory.yaml.
build_host_files.py now carries state/storage/depends_on into
generated hosts/*.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/apps.yaml

@@ -5,6 +5,7 @@ name: apps
 kind: lxc
 os: linux
 role: docker-apps
+state: active
 host: hubris
 pve_id: 105
 lan_ip: 192.168.8.205
@@ -33,21 +34,29 @@ services_hosted:
 - name: artifacto
   backend: apps
   url: https://artifacto.hubris.network
+  doc_page: containers/105-apps.md
+  config_repo: dtoro/Artifacto
 - name: homelab_mcp
   backend: apps
   port: 9810
   systemd_unit: homelab-mcp
   public_host: mcp.hubris.network
   endpoint: https://mcp.hubris.network/mcp
+  doc_page: infrastructure/homelab-context.md
+  config_repo: dtoro/Homelab-Docs
   note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via
     Netbird (192.168.8.0/24 is a network resource routed through hubris).
+  risk_notes: "agents' primary read surface \u2014 outage degrades every agent to grepping the clone"
 - name: secrets_issuance
   backend: apps
   port: 9820
   systemd_unit: secrets-issuance
   public_host: secrets.hubris.network
   endpoint: https://secrets.hubris.network/issue
+  doc_page: operations/agent-enrollment.md
+  config_repo: dtoro/Homelab-Docs
   note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
+  risk_notes: "identity issuance \u2014 any change is security-sensitive; key operations are destructive-class"
 age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 see_also:
 - containers/105-apps.md