security: remove all infrastructure and internal process material from the repo

The repo is source code and guidelines only. Nothing about how Archipelago's
own fleet is run, or how the team works, stays in it.

Untracked (kept on disk, gitignored) — 250 files:
- .planning/ (199) and loop/ — internal development process
- fleet operations tooling that targets specific nodes: deploy-to-target,
  deploy-tailscale, deploy-config-defaults, setup-target-dev, setup-aiui-server,
  setup-https-dev, debug-frontend, node-profile, fleet-fips-pair/unpair,
  image-recipe/sync-from-live.sh
- image-recipe/INTEGRATION-GUIDE.md and docs/multinode-testing-plan.md, both of
  which are live-server workflow and fleet node inventories
- the Phase 10 on-node verification and evidence records, which cite .planning/
  as their evidence base

KEY-05-ENTROPY-ENFORCEMENT.md was initially moved out with the other Phase 10
docs and then put back: it is cited as normative rationale from ten places in
the codebase, including core/clippy.toml, which bans rand::thread_rng and
points at it for the reason. That makes it a guideline, not an internal record.

Node names removed from source (48 occurrences across comments, manifests and
test fixtures): archi-dev-box, archy-x250*, shorty-s, framework-pt,
zaza-optiplex, archi-thinkpad. Comments keep the engineering context and the
date, which is what carried the meaning; the machine name did not.

Three of those were live test values rather than comments and were replaced
with valid stand-ins, not prose: two mDNS hostnames and a mesh peer name.
An earlier pass substituted "a test node" into a hostname assertion, producing
an invalid hostname; caught and fixed as test-node.local.

Wipe mechanism: .local-only/manifest.txt inventories every local-only path and
.local-only/wipe.sh deletes them on one confirmation, refusing to touch
anything git still tracks. Both are themselves untracked, so the public repo
does not carry a map of internal filenames.

Verified: cargo check -p archipelago --all-features clean; archipelago-container
75/75 tests pass; appOrigin vitest 7/7; audit-secrets 5/5; every relative link
in tracked markdown resolves (0 broken).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/container-doctor.sh

@@ -428,7 +428,7 @@ print(' '.join(['\"' + a + '\"' if ' ' in a else a for a in args[2:]]))
 # but silently loses outbound. Bitcoin IBD stalls at 0 peers; package pulls
 # fail. The repair must rebuild the netns from scratch: merely cycling the
 # containers reuses the existing (broken) netns because its holders
-# (aardvark-dns, podman's pause process) survive — observed on shorty-s
+# (aardvark-dns, podman's pause process) survive — observed on a test node
 # 2026-07-10, where the old stop/start-only cycle bounced all 35 containers
 # every timer run for ~an hour without ever restoring egress. So: stop the
 # containers, kill the netns holders, `podman system migrate`, clear the
@@ -610,7 +610,7 @@ fix_npm_public_hosts() {
 # A BTCPay store whose LND node has only private (unannounced) channels
 # produces BOLT11 invoices that external wallets cannot route to unless the
 # store's lightningPrivateRouteHints flag is on — payers see "no way to pay
-# this invoice" (observed on shorty-s 2026-07-10 with a Blink payer). Route
+# this invoice" (observed on a test node 2026-07-10 with a Blink payer). Route
 # hints are a no-op with public channels and essential with private ones, so
 # the doctor enforces the flag on every store. BTCPay reads store blobs from
 # Postgres per request; no restart needed.
@@ -636,7 +636,7 @@ fix_btcpay_route_hints() {
 # Podman resolves `--init` (and any Portainer/compose deploy with
 # "init: true") through catatonit; Debian's podman package only
 # Recommends it, so a node installed or upgraded without it fails those
-# deploys with a missing-init error (observed on shorty-s 2026-07-10
+# deploys with a missing-init error (observed on a test node 2026-07-10
 # deploying sites via Portainer). install-podman.sh covers fresh ISO
 # installs; this heals nodes that predate it.
 fix_missing_catatonit() {