orchestrator-hetzner: enable reboot-resilience + record migration

Now the workspace is staged on the Hetzner cpx22 (server 134487234, public
91.98.47.73, tailnet cc-ci-orchestrator-1 @ 100.84.190.30):

- configuration.nix: enable cc-ci-loops.service (wantedBy multi-user.target) so the
  loops + watchdog auto-resume on boot; wire reboot-log.sh as ExecStartPre so reboots
  auto-log to REBOOTS.md (boot_id-gated).
- plan-orchestrator-hetzner-migration.md: full migration record.
- REBOOTS.md / AGENTS.md: point the orchestrator host at Hetzner; first auto-logged
  reboot line.
- launch-orchestrator.sh: default session id -> the Hetzner orchestrator session.
- flake.lock: pin inputs.

Verified: nixos-rebuild switch applied; systemctl is-enabled cc-ci-loops.service =
enabled; ExecStartPre logged this boot to REBOOTS.md; loops healthy on phase 2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix

@@ -114,17 +114,18 @@ SSHCFG
     '';
   };
 
-  # cc-ci-loops supervisor — defined but NOT enabled until workspace is staged.
-  # Enable by adding wantedBy after staging (Stage 2e) for reboot-resilience.
+  # cc-ci-loops supervisor — workspace staged 2026-05-31, so ENABLED for reboot-resilience.
   systemd.services.cc-ci-loops = {
     description = "cc-ci Builder/Adversary loops + watchdog (launch.sh start)";
-    # wantedBy = [ "multi-user.target" ];  # uncomment after workspace is staged
+    wantedBy = [ "multi-user.target" ];  # enabled after workspace staged (Hetzner cutover)
     after = [ "network-online.target" "tailscaled.service" "claude-install.service" ];
     wants = [ "network-online.target" ];
     serviceConfig = {
       Type = "oneshot"; RemainAfterExit = true;
       User = "loops"; Group = "users";
       WorkingDirectory = "/srv/cc-ci";
+      # Append one line to REBOOTS.md per genuine reboot (boot_id-gated; not on manual restart).
+      ExecStartPre = "${pkgs.bash}/bin/bash /srv/cc-ci/cc-ci-plan/reboot-log.sh";
     };
     environment = { RESUME_PHASE = "1"; HOME = "/home/loops"; };
     path = [ pkgs.bash pkgs.tmux pkgs.git pkgs.python3 pkgs.openssh pkgs.nettools ];