cc-ci host: the orchestrator is an opencode agent; no Claude on the box; /secrets convention

Operator 2026-09-07 (evening): Claude sessions stay on notplants-orchestrator;
on the cc-ci host the orchestrator is an opencode agent (agents.toml:
opencode/glm-5.2) steered from https://oc.ci.commoninternet.net, next to the
upgrader/report sessions. claude-install and CLAUDE_BIN are gone from the
modules; launch-upgrader/report print the real UI URL; README "Operating the
orchestrator" rewritten and a "Weekly upgrade run" section added.

Secrets: only cc-ci's, under /secrets/files with runtime paths symlinked
(README §4 table), nothing from other projects — tangled key and the
tailscale line dropped from the host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/modules/orchestrator-host.nix

@@ -1,6 +1,6 @@
 # orchestrator-host.nix — the host contract that nix/modules/cc-ci.nix (the orchestrator's
 # loops/timers) silently assumes, made explicit and reusable: the `loops` user the agents run as,
-# the standalone claude/opencode CLIs, the shared opencode web server and its tailnet-only UI,
+# the standalone opencode CLI, the shared opencode web server and its basic-auth web UI,
 # nix-ld so foreign binaries run on NixOS, and the tool set agents reach for.
 #
 # Exported from flake.nix as `nixosModules.orchestrator-host`. A host imports this together with
@@ -79,12 +79,12 @@ in
       commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
     }];
 
-    # /home/loops/.local/bin holds the standalone claude + opencode binaries; it must be first on
-    # every PATH (interactive shells, tmux, the systemd units in cc-ci.nix prepend it too).
+    # /home/loops/.local/bin holds the standalone opencode binary; it must be first on every PATH
+    # (interactive shells, tmux, the systemd units in cc-ci.nix prepend it too).
     environment.variables.PATH = lib.mkForce
       "/home/loops/.local/bin:/run/current-system/sw/bin:/run/wrappers/bin:/usr/bin:/bin";
 
-    # ---- nix-ld: the standalone Claude Code / opencode CLIs are foreign dynamic ELF binaries ---
+    # ---- nix-ld: the standalone opencode CLI is a foreign dynamic ELF binary --------------------
     programs.nix-ld.enable = true;
     programs.nix-ld.libraries = with pkgs; [ stdenv.cc.cc.lib zlib openssl curl glibc ];
 
@@ -123,10 +123,6 @@ Host git.autonomic.zone
     User git
     IdentityFile /home/loops/.ssh/autonomic-bot-gitea-ed25519
     IdentitiesOnly yes
-
-Host tangled.org
-    IdentityFile /home/loops/.ssh/tangled-ed25519
-    IdentitiesOnly yes
 SSHCFG
         chmod 600 /home/loops/.ssh/config
         chown loops:users /home/loops/.ssh/config
@@ -134,22 +130,9 @@ SSHCFG
     '';
 
     # ---- standalone CLIs (idempotent installers; re-run on every activation, no-op if present) --
-    systemd.services.claude-install = {
-      description = "Install Claude Code CLI for loops user (idempotent)";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      serviceConfig = { Type = "oneshot"; RemainAfterExit = true; User = "loops"; Group = "users"; };
-      environment = { HOME = "/home/loops"; };
-      path = [ pkgs.curl pkgs.bash pkgs.coreutils pkgs.gnutar pkgs.gzip ];
-      script = ''
-        if [ ! -x "$HOME/.local/bin/claude" ]; then
-          echo "installing Claude Code CLI for loops user..."
-          curl -fsSL https://claude.ai/install.sh | bash || echo "install failed — retry on next activation"
-        fi
-      '';
-    };
-
+    # No Claude Code on this host (operator 2026-09-07): the orchestrator and the weekly upgrader
+    # are opencode agents; Claude sessions run on the notplants-orchestrator box and reach this
+    # host over ssh.
     systemd.services.opencode-install = {
       description = "Install opencode CLI for loops user (idempotent)";
       wantedBy = [ "multi-user.target" ];