decommission Pi: update all docs for VM-only setup

The orchestrator Pi is retired (2026-05-31). All agents now run on the
cc-ci-orchestrator VM (NixOS, loops user, /srv/cc-ci). The VM is a
direct tailnet peer to cc-ci — no SOCKS proxy, no userspace tailscaled,
no ProxyCommand. Updated across all affected files:

AGENTS.md
  - Remove Pi from reboot description; migration complete (not "parked")
  - cc-ci access: direct ssh, not via proxy

kickoff.md
  - Prerequisites: direct tailnet peer, not proxy
  - Host deps: NixOS (not apt)
  - Fallback/Incus: b1 reachable directly, no --proxy curl flag

plan.md §1 + §1.5
  - §1 bootstrap: direct SSH, check tailscale status (not restart proxy)
  - §1.5 intro: "VM" not "sandbox host"; no proxy
  - Credentials table: remove TS_AUTH_KEY row; update cc-ci SSH row
  - Replace "Tailscale connection (proxy)" subsection with direct-peer description

plan-orchestrator-migration.md
  - Mark COMPLETE (2026-05-31); historical record only

plan-phase1c-full-reproducibility.md
  - Incus access: direct, not via SOCKS proxy

prompts/builder.md + prompts/adversary.md
  - cc-ci access language only: direct ssh, no proxy restart instructions
  - adversary: *.ci.commoninternet.net via plain curl, no proxy flag

REBOOTS.md
  - Retitle for VM; note Pi retired; Pi entries marked historical

systemd/cc-ci-loops.service
  - User/Group/HOME/PATH: notplants → loops
  - Remove cc-ci-tailscaled.service dependency (no proxy on VM)
  - Add note about nix/configuration.nix as the authoritative VM declaration

test-e2e-testme-acceptance.md
  - tailscale status: no --socket flag
  - ssh to throwaway: no ProxyCommand

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cc-ci-plan/kickoff.md

@@ -70,8 +70,8 @@ account (`claude auth status`); set `REMOTE_CONTROL=0` to skip the remote surfac
 `claude` process, after which the watchdog brings it back (a fresh remote-control session) — and
 when `STATUS.md` shows `## DONE`, it kills the loops and exits.
 
-Prerequisites the sessions inherit from your shell: SSH (root) to `cc-ci` via the Tailscale proxy
-(§1.5), Gitea bot creds, and `git.autonomic.zone` access. Plus **preconfigured** operator inputs the
+Prerequisites the sessions inherit from your shell: SSH (root) to `cc-ci` directly (the orchestrator
+VM is a direct tailnet peer — no proxy; §1.5), Gitea bot creds, and `git.autonomic.zone` access. Plus **preconfigured** operator inputs the
 loop depends on (plan §4.0/§4.4): the wildcard `*.ci.commoninternet.net` DNS record pointing at a
 gateway that TLS-passthroughs to cc-ci, and the **pre-issued wildcard cert** at
 `/var/lib/ci-certs/live/` on cc-ci. The operator owns the DNS record + gateway + cert
@@ -79,8 +79,7 @@ issuance/renewal; the agent builds Traefik (file provider → that cert) + routi
 **no ACME**. If any prerequisite is absent, the Builder parks at `STATUS.md ## Blocked` (plan §1/§9)
 rather than improvise.
 
-> Host deps: `launch.sh` needs **tmux** (and `claude`) — tmux is installed on this sandbox host
-> (3.5a). On a fresh host: `sudo apt-get install -y tmux`. The script's `*_DIR`
+> Host deps: `launch.sh` needs **tmux** (and `claude`) — both are installed on the VM (NixOS). The script's `*_DIR`
 > defaults now point at `/srv/cc-ci/...` (Builder clone `/srv/cc-ci/cc-ci`, Adversary
 > `/srv/cc-ci/cc-ci-adv`); override the `*_DIR` env vars only if your layout differs.
 
@@ -112,13 +111,12 @@ re-bootstrap.
 (`100.117.251.31:8443`, Incus project `terraform-ci`). Skill + Terraform live at
 `/srv/incus-terraform-nix-vm-creator/` (`skills/incus-terraform/SKILL.md`); read that for full usage.
 
-- **Access:** b1 is on the *same* cc-ci tailnet, so reach the Incus API through the existing
-  `cc-ci-tailscaled` SOCKS proxy (`127.0.0.1:1055`) with the mTLS certs in that repo's
-  `terraform-secrets/` — no second tailscaled needed. Quick check:
+- **Access:** b1 (`100.117.251.31`) is reachable directly from the orchestrator VM (same tailnet).
+  Use the mTLS certs at `terraform-secrets/` — no proxy. Quick check:
   ```bash
   CRT=/srv/incus-terraform-nix-vm-creator/terraform-secrets/terraform.crt
   KEY=/srv/incus-terraform-nix-vm-creator/terraform-secrets/terraform.key
-  curl --proxy socks5h://localhost:1055 --cert "$CRT" --key "$KEY" -k -s \
+  curl --cert "$CRT" --key "$KEY" -k -s \
     https://100.117.251.31:8443/1.0/instances/cc-nix-test/state?project=terraform-ci
   ```
 - **Soft restart (keeps the disk — preferred):** `POST .../1.0/instances/cc-nix-test/state?project=terraform-ci`