weekly health-gated auto-update of the cc-ci host; skills rewritten for the combined host

nix/modules/auto-update.nix (own module, no notplants-nix dependency): Tuesday
03:00 UTC, busy-gated (CI run, weekly upgrader, report, sweep, running Drone
builds → skip), `nix flake update` → build → switch-to-configuration test →
cc-ci health checks (sshd, 0 failed units, core units, every swarm service at
replica count, sops decrypted, dashboard/reports/drone 200, opencode UI 401)
→ profile + bootloader → flake.lock committed and pushed to main → /etc/cc-ci
fast-forwarded; revert + lock restore on failure; one-line state file for
/cc-ci-status.

Skills (.opencode canonical, .claude pointers' descriptions synced):
- cc-ci-orchestrator-update: THE host update — drives the auto-update unit by
  hand; --cc-ci-only for a cc-ci-main-only move; failure playbook.
- cc-ci-server-update: delegates to it and explains why the old procedure
  (rebuilding the cc-ci repo's standalone #cc-ci) must not be run on this host.
- cc-ci-update: chains orchestrator-update then tests-update.
- cc-ci-status: §5/§6 for one host — auto-update state, generation vs boot
  generation, front doors (oc.ci = 401), sops, fail2ban, timers, orchestrator
  agent session, secrets inventory; verdict updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/hosts/cc-ci/configuration.nix

@@ -27,6 +27,9 @@
   # ---- orchestrator identity --------------------------------------------------------------
   # The CI server is this very host, so `ssh cc-ci` goes to loopback (the module default).
   cc-ci-orchestrator.ciSshHost = "127.0.0.1";
+  # Weekly self-update (Tue 03:00 UTC; skips itself while CI is busy; see nix/modules/auto-update.nix).
+  cc-ci-orchestrator.autoUpdate.enable = true;
+
   # The opencode UI: traefik (public 443, the *.ci.commoninternet.net cert) → nginx basic auth.
   cc-ci-orchestrator.opencodeUiHost = "oc.ci.commoninternet.net";
   cc-ci-orchestrator.opencodeUiTraefikNetwork = "proxy";