docs: fix plan/repo drift, retire dead Goose+Nomos and Caveman tooling

Documentation and repo-hygiene pass following the client/server split:

Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
  described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
  refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
  deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
  to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.

Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).

Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).

Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.

Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.

Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
  places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
  GetClientContext handler) since the mechanism's introduction on
  2026-06-02 — never matched any real filename, so no client has ever
  picked up an auto-setup script via git-pull or the context-poller sync.
  Fixed all three; the Go server-side fix is the one that actually matters
  since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
  (parsed, never consumed) left over from an earlier clone-based model.

Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.agents/skills/lifecycle-destroy-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-destroy-node
 risk_class: destructive
 inputs: [node_name]
-verification: "homelab node <name> relations returns unknown-entity; pct list on the backend no longer shows it"
+verification: "MCP get_blast_radius returns unknown-entity; pct list on the backend no longer shows it"
 docs_update_checklist: [archaeology_entry, containers_index_update]
 transition: "deprecated -> destroyed"
 ---
@@ -15,28 +15,35 @@ recipients removed + re-keyed, ingress/DNS removed, archaeology entry,
 ledger entry.
 
 1. Confirm the node is `deprecated` with zero `affected_by` edges
-   (`homelab node <name> relations`) — do not skip this even if the
-   deprecation runbook was followed recently; state can drift.
-2. If it's an enrolled client: `homelab client remove <name>` — revokes
-   the age key, re-keys SOPS, removes the inventory entry. This is
-   already destructive-class and confirmed in the CLI.
+   (MCP `get_blast_radius`) — do not skip this even if the deprecation
+   runbook was followed recently; state can drift.
+2. **If it's an enrolled client: no current tool for revoking its age key /
+   removing its Infisical identity.** The old `homelab client remove`
+   (age key revocation + SOPS re-key + inventory removal, all one
+   destructive-class CLI call) is retired along with the rest of that CLI
+   and hasn't been re-verified against the current enrollment
+   architecture (`POST /api/v1/clients/enroll` + Infisical machine
+   identities) — see the "Open questions" section in
+   [agent-enrollment.md](../../operations/agent-enrollment.md). Until
+   that's confirmed, treat key/identity revocation as a manual step:
+   at minimum remove the client's `age_pubkey` from any SOPS recipient
+   lists and rotate credentials whose ciphertext it already decrypted.
 3. Remove any ingress route (Caddy config repo) and DNS record still
    pointing at it.
 4. Verify backups of anything on it are retained per policy before the
    disk goes away (see `backs-up-to`).
 5. Destroy the LXC/VM (`pct destroy` / `qm destroy`).
-6. Move the `hosts.<name>:` block (if any inventory remnant survives
-   `client remove`, e.g. infra-only LXCs with no age key) into
-   inventory.yaml's `archaeology:` section: `pve_id`, `destroyed` date,
-   `reason`. Add a row to `containers/index.md` "Recently destroyed"
-   table (kept for human-readable browsing alongside the structured
-   data).
-7. `oikos/ledger.py append host:<name> destroy destructive --result ok`.
-8. Regenerate: `python3 mcp/build_host_files.py && python3
-   inventory.yaml` — the node drops out of `inventory.yaml` and
-   appears in the topology doc's archaeology table.
+6. Update the entity's `state` to `destroyed` in `seeds/inventory.yaml`
+   (or move it to an `archaeology:`-style section if the schema still has
+   one) — `pve_id`, `destroyed` date, `reason` — then `oikos seed` to
+   ingest. Add a row to `containers/index.md` "Recently destroyed" table
+   (kept for human-readable browsing alongside the structured data).
+7. No manual ledger step — mutations through the API are recorded
+   automatically in the `audit_log` table (MCP `get_audit_trail`,
+   `get_change_history`). The old `oikos/ledger.py append` was retired
+   when this became automatic.
 
-If the destroy fails partway (e.g. secrets revoked but pct destroy
-errors), do not re-run step 2 — `client remove` is not idempotent
-against a second revocation attempt on the issuance server. Finish the
-remaining steps manually and note the partial state in an investigation.
+If the destroy fails partway (e.g. secrets not fully revoked but pct
+destroy errors), finish the remaining steps manually and note the
+partial state in an investigation (MCP `upsert_knowledge`,
+`kind: investigation`).