scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

scripts/cutover-checklist.md

@@ -6,7 +6,7 @@ Status: [x] = done, [ ] = pending
 
 - [x] **Backup**: `pg_dump oikos > backups/pre-cutover-20260707.sql` (145K)
 - [x] **CI green**: pushed to main, `.gitea/workflows/ci.yml` exists
-- [x] **Deploy test**: Docker stack running with api + scheduler + notifier + nomos
+- [x] **Deploy test**: Docker stack running with api + scheduler + nomos
 - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
 - [x] **Secrets**: Infisical bootstrapped + migration complete 2026-07-07. All 11 SOPS secrets migrated to Infisical (oikos project, dev env). Machine identity `oikos-api` has RW access verified via Go SDK. ENCRYPTION_KEY must be 32-char raw string (docs incorrect). SOPS fallback preserved for DR. secrets-issuance decommissioned — stopped/disabled on apps/105; superseded by Infisical.

scripts/deploy.sh

@@ -8,8 +8,8 @@
 #   D2 — versioned images: tags every built image v$VERSION (from VERSION file),
 #        keeps the last 3 tags per service for rollback.
 
-# Notify on deploy failure via Matrix. Uses Oikos API to raise an event
-# so the scheduler picks it up and alerts via the notifier.
+# Notify on deploy failure. Uses Oikos API to raise an event
+# so the scheduler picks it up.
 notify_deploy_failure() {
     local reason="$1"
     local sha="${SHA:-unknown}"
@@ -22,7 +22,7 @@ notify_deploy_failure() {
             -d "{\"type\":\"deploy.failed\",\"severity\":\"critical\",\"source\":\"webhook\",\"data\":{\"sha\":\"$sha\",\"reason\":\"$reason\"}}" \
             >/dev/null 2>&1 || true
     fi
-    # Also try Matrix directly via the notifier's webhook endpoint if configured
+    # if configured
     if [ -n "${MATRIX_WEBHOOK_URL:-}" ]; then
         curl -sf -X POST "$MATRIX_WEBHOOK_URL" \
             -H "Content-Type: application/json" \
@@ -238,7 +238,7 @@ echo "[6/8] prune old image tags (keep 3)"
 if [ -n "$OIKOS_VERSION" ]; then
     images=$(docker compose --profile "$PROFILE" config --images 2>/dev/null || true)
     if [ -z "$images" ]; then
-        images="oikos-api oikos-scheduler oikos-notifier oikos-migrate oikos-seed oikos-nomos oikos-web"
+        images="oikos-api oikos-scheduler oikos-migrate oikos-seed oikos-nomos oikos-web"
     fi
     printf '%s\n' $images | sed 's/:.*//' | grep '^oikos-' | sort -u | while read -r repo; do
         docker image ls "$repo" --format '{{.Tag}}' 2>/dev/null | grep '^v' | sort -rV | tail -n +4 | while read -r tag; do

scripts/seed-secrets.sh

@@ -49,16 +49,12 @@ seed_key() {
     fi
 }
 
-matrix_token="$(get_container_env notifier OIKOS_MATRIX_TOKEN)"
-approval_hmac="$(get_container_env notifier OIKOS_APPROVAL_HMAC_SECRET)"
 mcp_token="$(get_container_env api OIKOS_MCP_BEARER_TOKEN)"
 openrouter_key="$(get_container_env nomos OPENROUTER_API_KEY)"
 webhook_hmac="$(get_container_env api WEBHOOK_HMAC_SECRET 2>/dev/null)"
 
 api_token="$mcp_token"
 
-seed_key "matrix_token"         "$matrix_token"
-seed_key "approval_hmac-secret" "$approval_hmac"
 seed_key "mcp_bearer-token"     "$mcp_token"
 seed_key "api_token"            "$api_token"
 seed_key "openrouter_api-key"   "$openrouter_key"