scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

internal/config/config.go

@@ -37,7 +37,7 @@ type Config struct {
 	APIRateBurst int
 
 	// Health probe HTTP listener (plan D5). Background-loop roles (scheduler,
-	// notifier) expose a staleness-aware /healthz here. Empty disables the
+	// execution-worker) expose a staleness-aware /healthz here. Empty disables the
 	// health server (local/non-docker runs).
 	HealthListen string
 
@@ -53,12 +53,6 @@ type Config struct {
 	// Scheduler (Phase 3)
 	SchedulerInterval time.Duration // check loop interval (default 30s)
 
-	// Notifier (Phase 3)
-	MatrixHomeserver string // Matrix server URL
-	MatrixUserID     string // bot user ID (e.g. @oikos:matrix.hubris.network)
-	MatrixToken      string // Matrix access token
-	MatrixRoomID     string // alert room ID
-
 	// Actuator (Phase 3)
 	SSHKeyPath       string // path to the restricted SSH key
 	SSHUser          string // SSH user on targets (default "oikos")
@@ -68,9 +62,6 @@ type Config struct {
 	// Learning (Phase 3)
 	LearningInterval time.Duration // pattern extraction interval (default 3600s)
 
-	// Approval HMAC secret (Phase 3)
-	ApprovalHMACSecret string
-
 	// Nomos agent entity ID (Phase 4)
 	NomosAgentID   string
 	NomosAgentSlug string
@@ -148,18 +139,6 @@ func FromEnv() Config {
 			c.SchedulerInterval = d
 		}
 	}
-	if v := os.Getenv("OIKOS_MATRIX_HOMESERVER"); v != "" {
-		c.MatrixHomeserver = v
-	}
-	if v := os.Getenv("OIKOS_MATRIX_USER"); v != "" {
-		c.MatrixUserID = v
-	}
-	if v := os.Getenv("OIKOS_MATRIX_TOKEN"); v != "" {
-		c.MatrixToken = v
-	}
-	if v := os.Getenv("OIKOS_MATRIX_ROOM"); v != "" {
-		c.MatrixRoomID = v
-	}
 	if v := os.Getenv("OIKOS_SSH_KEY_PATH"); v != "" {
 		c.SSHKeyPath = v
 	}
@@ -177,9 +156,6 @@ func FromEnv() Config {
 			c.LearningInterval = d
 		}
 	}
-	if v := os.Getenv("OIKOS_APPROVAL_HMAC_SECRET"); v != "" {
-		c.ApprovalHMACSecret = v
-	}
 	if v := os.Getenv("OIKOS_NOMOS_AGENT_ID"); v != "" {
 		c.NomosAgentID = v
 	}