chore: graph view, dns-zone gap, fleet deploy/cleanup tooling

Graph view: raise the node cap 500 -> 2000 and exclude execution/task audit
rows from the default whole-graph view so the cap is spent on actual topology
rather than ~380 cognition records that crowded out every host/lxc/service.

dns-zone monitoring [dns] -> none: no dns checker exists, so the declaration
only produced unresolvable `unmonitored` noise (requires ontology re-ingest;
coverageSweep now auto-clears the stale signals). Flip back to [dns] when a
checker lands.

Operator tooling: tools/deploy-checks.sh pushes check scripts into guests via
pct push (a pct-exec-routed check runs the script INSIDE the guest), wired
into the post-pull setup-checks hook so guests stay in sync on Proxmox hosts;
scripts/cleanup-orphan-checks.sh (dry-run by default) and
report-stray-test-lxcs.sh retire legacy cruft. VERSION 0.13.0 -> 0.14.0.

Plan: plans/2026-07-29-health-check-reality-and-knowledge-graph.md.

scripts/cleanup-orphan-checks.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# cleanup-orphan-checks.sh — remove orphan check entities + check_defs.
+#
+# These are leftovers from the old shortSlug() collision bug: check entities
+# with truncated 8-hex slugs (e.g. check:ssh-script:0d31fdd1) that have no
+# live target and are disabled. They pollute the entity table and the checks
+# view. The audit_knowledge_graph tool reports them as `orphan_checks`.
+#
+# Risk class: config_mutation (deletes rows). DRY-RUN by default; pass --apply
+# to actually delete. Review the listed slugs first — they must all match the
+# legacy random-slug pattern and be disabled.
+#
+# Usage:
+#   cleanup-orphan-checks.sh            # dry-run: list what would be deleted
+#   cleanup-orphan-checks.sh --apply    # delete check_defs rows, then entities
+#
+# Connects via the OIKOS_TEST... no — via the running postgres container by
+# default, or OIKOS_PSQL if set.
+set -euo pipefail
+
+PSQL_CMD="${OIKOS_PSQL:-docker exec -i oikos-postgres-1 psql -U oikos -d oikos}"
+PATTERN='^check:(ping|ssh-script|disk):[0-9a-f]{8}$'
+
+# Orphan = matches the legacy random-slug pattern AND has no enabled check_def
+# pointing at a real target. A random-slug check that IS enabled and has a live
+# target is a working check with a bad slug — keep it (deleting would drop
+# monitoring), and flag it for a slug fix instead.
+ORPHAN_PRED="e.type='check' AND e.slug ~ '$PATTERN'
+  AND NOT EXISTS (SELECT 1 FROM check_defs cd
+                  WHERE cd.entity_id = e.id AND cd.enabled AND cd.target_id IS NOT NULL)"
+
+echo "== orphan checks matching /$PATTERN/ (no enabled check_def w/ target) =="
+$PSQL_CMD -tAc "SELECT count(*) FROM entities e WHERE $ORPHAN_PRED;"
+
+echo "== details (slug, state, enabled) =="
+$PSQL_CMD -F ' | ' -Ac "
+SELECT e.slug, COALESCE(e.state,'(null)'),
+       COALESCE((SELECT cd.enabled::text FROM check_defs cd WHERE cd.entity_id=e.id LIMIT 1),'no-check_def')
+FROM entities e
+WHERE $ORPHAN_PRED
+ORDER BY e.slug;" | head -60
+
+if [ "${1:-}" != "--apply" ]; then
+  echo
+  echo "DRY RUN — no rows deleted. Re-run with --apply to delete:"
+  echo "  check_defs whose check entity is an orphan, then those entities."
+  exit 0
+fi
+
+echo
+echo "== applying (config_mutation) =="
+# Delete check_defs first (FK), then the orphan check entities.
+$PSQL_CMD -v ON_ERROR_STOP=1 <<SQL
+BEGIN;
+DELETE FROM check_defs WHERE entity_id IN (SELECT id FROM entities e WHERE $ORPHAN_PRED);
+DELETE FROM entities e WHERE $ORPHAN_PRED;
+COMMIT;
+SQL
+
+echo "== remaining orphans (should be 0) =="
+$PSQL_CMD -tAc "SELECT count(*) FROM entities e WHERE $ORPHAN_PRED;"

scripts/report-stray-test-lxcs.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# report-stray-test-lxcs.sh — list leftover test/scratch LXC entities.
+#
+# Provisioning experiments leave active `lxc:test-*` / `lxc:preflight-*`
+# entities in the graph long after the containers are gone or repurposed.
+# They generate checks and pollute health/graph views. This reports them and
+# their DB state + which Proxmox host each is parented on, so the operator can
+# confirm the container is really gone and retire the entity via the
+# lifecycle-destroy-node runbook (a destructive, approval-gated action).
+#
+# Read-only. Pair with: lifecycle-destroy-node (mark destroyed) or
+# lifecycle-deprecate-node.
+set -euo pipefail
+
+PSQL_CMD="${OIKOS_PSQL:-docker exec -i oikos-postgres-1 psql -U oikos -d oikos}"
+
+echo "== stray test/scratch LXC entities =="
+$PSQL_CMD -F ' | ' -Ac "
+SELECT e.slug, COALESCE(e.state,'active') AS state,
+       e.attributes->>'pve_id' AS pve_id,
+       COALESCE(h.slug,'(no host)') AS host
+FROM entities e
+LEFT JOIN relationships r ON r.target_id = e.id AND r.type='hosts' AND r.valid_to IS NULL
+LEFT JOIN entities h ON h.id = r.source_id
+WHERE e.type='lxc' AND e.slug ~ '^lxc:(test|preflight)'
+ORDER BY e.slug;"
+
+echo
+echo "Next: for each, confirm the container is gone in Proxmox (pct list on its"
+echo "host), then retire via lifecycle-destroy-node (destructive) or mark"
+echo "deprecated. If a container still exists, pct destroy it first."