scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

README.md

@@ -13,7 +13,7 @@ learns from outcomes, and escalates when uncertain.
 ## Quick start
 
 ```bash
-# Dev stack (postgres + api + scheduler + notifier). The api/nomos
+# Dev stack (postgres + api + scheduler). The api/nomos
 # services need a shared token — every route requires a real bearer
 # credential, there's no dev-open bypass.
 OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile dev up -d
@@ -42,8 +42,8 @@ cd web && OIKOS_API_TOKEN=dev-token npm run dev   # http://localhost:5173
   Workstation ─── │  nomos (8092) ──MCP── api (8090) │
   (mesh)          │    MCP gateway      REST + MCP    │
                   │                                   │
-                  │  scheduler ── notifier ── postgres │
-                  │  (observe)    (Matrix)   (Timescale)│
+                  │  scheduler ─── postgres             │
+                  │  (observe)    (Timescale)          │
                   └──────────────────────────────────┘
 ```
 
@@ -51,7 +51,6 @@ cd web && OIKOS_API_TOKEN=dev-token npm run dev   # http://localhost:5173
 |-----------|------|------|
 | `oikos api` | 8090 | REST API + MCP server (tool list in [AGENTS.md §3](AGENTS.md#3-the-mcp-server)) |
 | `oikos scheduler` | — | Probe runner, signal lifecycle, metrics |
-| `oikos notifier` | — | Approval tokens, Matrix alerts |
 | `nomos serve` | 8092 | MCP client gateway, query routing |
 
 ## Phases
@@ -60,7 +59,7 @@ cd web && OIKOS_API_TOKEN=dev-token npm run dev   # http://localhost:5173
 |-------|--------|-------------|
 | 1 — Ontology + DB | ✅ | TimescaleDB, migrations, seeds, blast_radius |
 | 2 — API | ✅ | OpenAPI-first REST + MCP, auth, SSE, audit |
-| 3 — Control loop | ✅ | Scheduler, actuator, learning, classifier, notifier |
+| 3 — Control loop | ✅ | Scheduler, actuator, learning, classifier |
 | 4 — Nomos agent | ✅ | Standalone MCP client gateway, agent activity |
 | 5 — Secrets | ✅ | Infisical backend + SOPS fallback, rotation runbooks |
 | 6 — Deploy | ✅ | CI pipeline, cutover checklist, watchdog, rollback |
@@ -100,7 +99,6 @@ oikos seed        # ingest ontology/inventory/policy seeds
 oikos export      # export DB state to YAML
 oikos api         # serve REST + MCP
 oikos scheduler   # run observe loop
-oikos notifier    # run notification loop
 oikos all         # all roles in one process
 oikos secret list # enumerate SOPS secrets
 oikos secret migrate  # SOPS → Infisical
@@ -123,7 +121,7 @@ cmd/nomos/          Nomos MCP client gateway
 cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 cmd/desktop/        Wails desktop wrapper around the SPA
 internal/           Go packages (actuator, checkdefaults, config, db, domain,
-                    httpapi, knowledge, learning, mcp, notifier, observability,
+                    httpapi, knowledge, learning, mcp, observability,
                     ontology, policy, safego, scheduler, secrets)
 web/                Control-room SPA (Svelte 5) — standalone, not embedded
 api/openapi.yaml    API contract (OpenAPI 3.1)