docs: fix plan/repo drift, retire dead Goose+Nomos and Caveman tooling

Documentation and repo-hygiene pass following the client/server split:

Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
  described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
  refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
  deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
  to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.

Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).

Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).

Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.

Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.

Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
  places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
  GetClientContext handler) since the mechanism's introduction on
  2026-06-02 — never matched any real filename, so no client has ever
  picked up an auto-setup script via git-pull or the context-poller sync.
  Fixed all three; the Go server-side fix is the one that actually matters
  since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
  (parsed, never consumed) left over from an earlier clone-based model.

Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.agents/skills/lifecycle-activate-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-activate-node
 risk_class: config_mutation
 inputs: [node_name]
-verification: "homelab service <name> health (if it hosts a service); homelab doctor (if it's a client)"
+verification: "MCP get_service_status (if it hosts a service); MCP whoami (if it's a client)"
 docs_update_checklist: [doc_page_complete]
 transition: "provisioning -> active"
 ---
@@ -14,23 +14,22 @@ enrolled if it needs secrets, mesh joined if it needs off-LAN reach,
 ingress live if public, health check answering, doc page complete,
 ledger entry.
 
-1. If the node is a `homelab` client: finish enrollment per
-   [client-enrollment.md](../client-enrollment/SKILL.md) (`--finalize-pubkey`,
-   mesh join, `homelab doctor` green).
+1. If the node self-enrolls as a client: finish enrollment per
+   [CLIENTS.md](../../../CLIENTS.md#enrollment) (`bootstrap.sh` →
+   `/api/v1/clients/enroll`, mesh join, MCP `whoami` returns the entity).
 2. If it hosts a public service: add the `services:` entry in
-   `inventory.yaml` (backend, url, doc_page, config_repo, risk_notes —
-   see the Week-1 service contract fields) and wire the Caddy route in
-   `dtoro/caddy-conf`.
-3. Confirm the health check answers: `homelab service <name> health` or
-   a direct `curl`.
+   `seeds/inventory.yaml` (backend, url, doc_page, config_repo,
+   risk_notes) and wire the Caddy route in `dtoro/caddy-conf`.
+3. Confirm the health check answers: MCP `get_service_status` or a
+   direct `curl`.
 4. Flip `state: provisioning` → `state: active` (or delete the `state:`
-   field — `active` is the default) in `inventory.yaml`.
+   field — `active` is the default) in `seeds/inventory.yaml`, then
+   `oikos seed` to ingest.
 5. Complete the doc page (stub → full narrative: role, specs, how it's
    configured, dependencies).
-6. Record the activation: `oikos/ledger.py append host:<name> activate
-   config_mutation --result ok` (or let the CLI wrapper do this once
-   Week 3's runbook automation lands).
+6. No manual record-keeping step needed — the activation (via whatever
+   API call flipped the state) is recorded automatically in `audit_log`.
 
-Regenerate derived data: `python3 mcp/build_host_files.py && python3
-inventory.yaml` so `inventory.yaml`, the topology diagram, and
-the context card all reflect the new state.
+Regenerate: `oikos seed` re-ingests `seeds/inventory.yaml`; `oikos export`
+writes DB state back out to the YAML if you mutated via the API/MCP
+instead of editing the file directly.