security: remove all infrastructure and internal process material from the repo

The repo is source code and guidelines only. Nothing about how Archipelago's
own fleet is run, or how the team works, stays in it.

Untracked (kept on disk, gitignored) — 250 files:
- .planning/ (199) and loop/ — internal development process
- fleet operations tooling that targets specific nodes: deploy-to-target,
  deploy-tailscale, deploy-config-defaults, setup-target-dev, setup-aiui-server,
  setup-https-dev, debug-frontend, node-profile, fleet-fips-pair/unpair,
  image-recipe/sync-from-live.sh
- image-recipe/INTEGRATION-GUIDE.md and docs/multinode-testing-plan.md, both of
  which are live-server workflow and fleet node inventories
- the Phase 10 on-node verification and evidence records, which cite .planning/
  as their evidence base

KEY-05-ENTROPY-ENFORCEMENT.md was initially moved out with the other Phase 10
docs and then put back: it is cited as normative rationale from ten places in
the codebase, including core/clippy.toml, which bans rand::thread_rng and
points at it for the reason. That makes it a guideline, not an internal record.

Node names removed from source (48 occurrences across comments, manifests and
test fixtures): archi-dev-box, archy-x250*, shorty-s, framework-pt,
zaza-optiplex, archi-thinkpad. Comments keep the engineering context and the
date, which is what carried the meaning; the machine name did not.

Three of those were live test values rather than comments and were replaced
with valid stand-ins, not prose: two mDNS hostnames and a mesh peer name.
An earlier pass substituted "a test node" into a hostname assertion, producing
an invalid hostname; caught and fixed as test-node.local.

Wipe mechanism: .local-only/manifest.txt inventories every local-only path and
.local-only/wipe.sh deletes them on one confirmation, refusing to touch
anything git still tracks. Both are themselves untracked, so the public repo
does not carry a map of internal filenames.

Verified: cargo check -p archipelago --all-features clean; archipelago-container
75/75 tests pass; appOrigin vitest 7/7; audit-secrets 5/5; every relative link
in tracked markdown resolves (0 broken).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Android/app/src/main/java/com/archipelago/app/fips/ArchyVpnService.kt

@@ -150,7 +150,7 @@ class ArchyVpnService : VpnService() {
      * Pre-warm + keep-warm mesh sessions to every known node ULA.
      *
      * Discovery + first session through the public tree can take 15s+
-     * (HANDOFF-2026-07-23 node diagnosis) — paying that cost here, the
+     * (from node diagnosis) — paying that cost here, the
      * moment the tunnel is up, means the connect probe and WebView hit an
      * established session instead of timing out on a cold one. The periodic
      * touch afterwards keeps the session from idling out. Failed connects

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -331,7 +331,7 @@ class FipsPreferences(private val context: Context) {
 
 /**
  * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
- * that isn't a valid DNS label ("Framework PT" — the space) gets rejected and
+ * that isn't a valid DNS label ("Test Node" — the space) gets rejected and
  * silently drops the peer from name resolution. Slug it instead of losing it.
  */
 internal fun hostSafeAlias(alias: String): String =

Android/app/src/main/java/com/archipelago/app/fips/FlareServer.kt

@@ -330,7 +330,7 @@ object FlareServer {
 /** Outbound flares: plain HTTP to the peer's ULA — FIPS encrypts underneath. */
 object FlareClient {
     // Connect timeout must outlive cold mesh-session establishment (~15s via
-    // the public tree per HANDOFF-2026-07-23); the attempt itself drives
+    // the public tree); the attempt itself drives
     // session setup, same trick as the VPN service's session warmer.
     private val http = OkHttpClient.Builder()
         .connectTimeout(25, TimeUnit.SECONDS)

Android/app/src/main/java/com/archipelago/app/ui/screens/ServerConnectScreen.kt

@@ -187,7 +187,7 @@ fun ServerConnectScreen(
                     port = "",
                 )
                 // Mesh discovery + first session can take 15s+ through the
-                // public tree (HANDOFF-2026-07-23 node diagnosis), and on a
+                // public tree (per node diagnosis), and on a
                 // first-ever pairing the VPN consent dialog is on screen at
                 // the same time — so probe patiently inside a 60s budget with
                 // per-attempt timeouts wide enough to ride out TCP