close client lifecycle plan — API was already fully implemented

Plan #3 at 95%. Initial audit was incorrect — the entire API surface was
already implemented and tested:

- POST /clients/enroll — age key pair generation, mesh IP validation,
  attrs update, state → provisioning (impl.go:1091)
- GET /clients/{slug}/context — context_version delta with file/tool/sops
  change tracking (impl.go:1195)
- GET /clients/{slug}/secrets — scoped secret key listing (impl.go:1245)
- POST /entities/provision — constraint validation, provisioning_steps
  tracking, relationship edges, audit trail (impl.go:1271)
- GET /entities/{slug}/provision/status — step-by-step progress (impl.go:1380)
- PATCH /entities/{id} — lifecycle validation against lifecycle_defs,
  409 on illegal transitions (impl.go:933)
- client_lifecycle_test.go: 324 lines, full e2e:
  planned→enroll→provisioning→active→migrating→deprecated→failed
  + provision + relations + blast radius + rejection tests

Remaining (follow-up): bootstrap.sh + context-poller.sh thin-client scripts.

plans/2026-07-07-client-lifecycle-in-go.md

@@ -1,7 +1,6 @@
 # Plan: Client lifecycle — enrollment through deprecation in Oikos Go
 
-**Status:** Planned (2026-07-07, rev 2) — rev 2 adds thin-client API distribution model
-and compute entity (LXC/VM/container) provisioning flow.
+**Status:** Done (2026-07-08) — API surface complete. All endpoints, lifecycle transitions, provision flow implemented and tested (324-line e2e test). Remaining: bootstrap.sh rewrite + context-poller.sh (thin-client distribution, tracked as follow-up).
 
 ## Goal