weekly health-gated auto-update of the cc-ci host; skills rewritten for the combined host

nix/modules/auto-update.nix (own module, no notplants-nix dependency): Tuesday
03:00 UTC, busy-gated (CI run, weekly upgrader, report, sweep, running Drone
builds → skip), `nix flake update` → build → switch-to-configuration test →
cc-ci health checks (sshd, 0 failed units, core units, every swarm service at
replica count, sops decrypted, dashboard/reports/drone 200, opencode UI 401)
→ profile + bootloader → flake.lock committed and pushed to main → /etc/cc-ci
fast-forwarded; revert + lock restore on failure; one-line state file for
/cc-ci-status.

Skills (.opencode canonical, .claude pointers' descriptions synced):
- cc-ci-orchestrator-update: THE host update — drives the auto-update unit by
  hand; --cc-ci-only for a cc-ci-main-only move; failure playbook.
- cc-ci-server-update: delegates to it and explains why the old procedure
  (rebuilding the cc-ci repo's standalone #cc-ci) must not be run on this host.
- cc-ci-update: chains orchestrator-update then tests-update.
- cc-ci-status: §5/§6 for one host — auto-update state, generation vs boot
  generation, front doors (oc.ci = 401), sops, fail2ban, timers, orchestrator
  agent session, secrets inventory; verdict updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

flake.nix

@@ -31,6 +31,8 @@
         # The host contract those units assume: loops user, claude/opencode CLIs, opencode web
         # server + tailnet UI, nix-ld, tool set, `ssh cc-ci` config.
         orchestrator-host = ./nix/modules/orchestrator-host.nix;
+        # Weekly health-gated self-update of the host (busy-gated around CI runs).
+        auto-update = ./nix/modules/auto-update.nix;
         # Old name of cc-ci-orchestrator, kept while notplants-nix still imports it (2026-09).
         cc-ci = ./nix/modules/cc-ci.nix;
       };
@@ -44,6 +46,7 @@
             cc-ci.nixosModules.cc-ci-server
             self.nixosModules.cc-ci-orchestrator
             self.nixosModules.orchestrator-host
+            self.nixosModules.auto-update
             ./nix/hosts/cc-ci/configuration.nix
           ];
         };