Oikos Week 1: kernel policy, ontology, service contract, topology gen

Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes +
approval rules for every homelab/MCP command), oikos/ontology.yaml
(8-domain systems model, typed relationships, node lifecycle), and
OIKOS.md (OODA loop operating brief, linked from AGENTS.md).

Extends inventory.yaml with a stable service contract (doc_page,
config_repo, risk_notes) on all 17 services, and a structured
archaeology: section for the 13 destroyed LXCs (was scattered
comments + a narrative table). Fixes stale drift found in the
process: authentik's backend pointed at a retired LXC (124); core
has run on the VPS since 2026-05-31.

Adds oikos/gen-topology.py, generating infrastructure/topology.md
(Mermaid compute/ingress + storage views) from inventory.yaml.
build_host_files.py now carries state/storage/depends_on into
generated hosts/*.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mcp/build_host_files.py

@@ -68,8 +68,12 @@ def build_one(name: str, entry: dict, inventory: dict) -> dict:
         "kind": entry.get("kind"),
         "os": entry.get("os"),
         "role": entry.get("role"),
+        # Oikos lifecycle (oikos/ontology.yaml); absent in inventory = active
+        "state": entry.get("state", "active"),
         "host": entry.get("host"),
         "pve_id": pve_id,
+        "storage": entry.get("storage"),
+        "depends_on": entry.get("depends_on", []),
         "lan_ip": entry.get("lan_ip"),
         "mesh": entry.get("mesh", {}),
         "mesh_globals": {