[claude-agent-service] Remove orphaned DevVM SSH key wiring

## Context

The remote-executor pattern that SSHed into the DevVM (10.0.10.10) to run
`claude -p` was fully migrated to the in-cluster service
`claude-agent-service.claude-agent.svc:8080/execute` in commits 42f1c3cf and
99180bec (2026-04-18). Five parallel codebase audits (GH Actions, Woodpecker
+ scripts, K8s CronJobs/Deployments, n8n, local scripts/hooks/docs) confirmed
zero remaining SSH+claude sites.

This commit removes two cleanup artifacts left behind by that migration.

## This change

1. Deletes `.claude/skills/archived/setup-remote-executor.md` — the archived
   skill doc for the obsolete SSH-based pattern. Already in `archived/`,
   harmless but noise; deleting prevents anyone copy-pasting the old approach.

2. Removes `kubernetes_secret.ssh_key` from
   `stacks/claude-agent-service/main.tf`. The Secret was created from the
   `devvm_ssh_key` field at Vault `secret/ci/infra` but was never mounted
   into the agent pod. The pod's `git-init` init container uses HTTPS +
   `$GITHUB_TOKEN` exclusively and force-rewrites every `git@github.com:`
   and `https://github.com/` URL via `git config url.insteadOf`, so no
   downstream `git` invocation could fall through to SSH even if it tried.

3. Removes the now-orphaned `data "vault_kv_secret_v2" "ci_secrets"` block —
   the SSH key resource was its only consumer.

## What is NOT in this change

- The `devvm_ssh_key` field at Vault `secret/ci/infra` stays in place.
  Removing it requires read/modify/put of the full secret and the upside
  is one unused Vault key. Not worth it without strong justification.
- DevVM host decommission is out of scope (separate audit needed for
  non-Claude users of the host).
- Pre-existing `terraform fmt` warnings at lines 464-505 (CronJob alignment)
  left untouched per no-adjacent-refactor rule.

## Test plan

### Automated

- `terraform fmt -check stacks/claude-agent-service/main.tf` — only the
  pre-existing lines 464-505 are flagged; no new fmt warnings introduced
  by these deletions.

### Manual verification

1. `cd infra/stacks/claude-agent-service && ../../scripts/tg apply`
2. Expect exactly one resource destroyed: `kubernetes_secret.ssh_key`.
   The `ci_secrets` data source removal is plan-time only; does not appear
   in resource counts.
3. `kubectl -n claude-agent get secret ssh-key` → `NotFound`.
4. `kubectl -n claude-agent get pod` → both pods Running, no restart events.
5. Submit a synthetic agent job via HTTP API to confirm pipeline still works:
   curl -X POST http://claude-agent-service.claude-agent.svc.cluster.local:8080/execute
   with a minimal prompt; expect job completes with `exit_code=0`.

Closes: code-bck

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/archived/setup-remote-executor.md

@@ -1,102 +0,0 @@
-# Setup Shared Remote Executor
-
-Skill for setting up Claude Code's shared remote executor in new projects.
-
-## When to Use
-- When adding Claude Code support to a new project
-- When the user says "set up remote executor for this project"
-- When working on a new project that needs remote command execution
-
-## Prerequisites
-- Shared executor already deployed at `~/.claude/` on wizard@10.0.10.10
-- Project accessible via NFS from both macOS and the remote VM
-
-## Setup Steps
-
-### 1. Create .claude Directory
-```bash
-mkdir -p .claude/sessions
-```
-
-### 2. Create session-exec.sh Wrapper
-Create `.claude/session-exec.sh` with the following content (adjust PROJECT_ROOT):
-
-```bash
-#!/bin/bash
-# Project-Local Session Helper - Wrapper for shared executor
-
-set -euo pipefail
-
-SHARED_SESSION_EXEC="/home/wizard/.claude/session-exec.sh"
-PROJECT_ROOT="/home/wizard/path/to/project"  # UPDATE THIS
-
-if [ -f "$SHARED_SESSION_EXEC" ]; then
-    if [ "${1:-}" = "create" ] || [ -z "${1:-}" ]; then
-        "$SHARED_SESSION_EXEC" create "$PROJECT_ROOT"
-    else
-        "$SHARED_SESSION_EXEC" "$@"
-    fi
-else
-    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-    SESSIONS_DIR="$SCRIPT_DIR/sessions"
-    SESSION_ID="${1:-$(date +%s)-$$-$RANDOM}"
-    ACTION="${2:-create}"
-    SESSION_DIR="$SESSIONS_DIR/$SESSION_ID"
-
-    case "$ACTION" in
-        create|init|"")
-            mkdir -p "$SESSION_DIR"
-            echo "ready" > "$SESSION_DIR/cmd_status.txt"
-            echo "$PROJECT_ROOT" > "$SESSION_DIR/workdir.txt"
-            > "$SESSION_DIR/cmd_input.txt"
-            > "$SESSION_DIR/cmd_output.txt"
-            echo "$SESSION_ID"
-            ;;
-        cleanup|remove|delete)
-            [ -d "$SESSION_DIR" ] && rm -rf "$SESSION_DIR"
-            ;;
-        status)
-            [ -d "$SESSION_DIR" ] && cat "$SESSION_DIR/cmd_status.txt"
-            ;;
-        list)
-            [ -d "$SESSIONS_DIR" ] && ls -1 "$SESSIONS_DIR" 2>/dev/null
-            ;;
-    esac
-fi
-```
-
-Make executable: `chmod +x .claude/session-exec.sh`
-
-### 3. Link Sessions Directory (on remote VM)
-Run on the remote VM to add project sessions to the shared executor:
-
-```bash
-# Option A: Symlink project sessions (if using project-local sessions)
-ln -sfn /path/to/project/.claude/sessions ~/.claude/sessions
-
-# Option B: Use shared sessions (all projects share one directory)
-# Just ensure ~/.claude/sessions exists
-```
-
-### 4. Create CLAUDE.md
-Add execution instructions to `.claude/CLAUDE.md`:
-
-```markdown
-## Remote Command Execution
-Uses shared executor at `~/.claude/` on wizard@10.0.10.10.
-
-### Usage
-\```bash
-SESSION_ID=$(.claude/session-exec.sh)
-echo "command" > .claude/sessions/$SESSION_ID/cmd_input.txt
-sleep 1 && cat .claude/sessions/$SESSION_ID/cmd_status.txt
-cat .claude/sessions/$SESSION_ID/cmd_output.txt
-\```
-
-Start executor: `~/.claude/remote-executor.sh` (on remote VM)
-```
-
-## Shared Executor Location
-- Scripts: `~/.claude/remote-executor.sh`, `~/.claude/session-exec.sh`
-- Sessions: `~/.claude/sessions/`
-- Remote VM: wizard@10.0.10.10

stacks/claude-agent-service/main.tf

@@ -3,11 +3,6 @@ data "vault_kv_secret_v2" "secrets" {
   name  = "claude-agent-service"
 }
 
-data "vault_kv_secret_v2" "ci_secrets" {
-  mount = "secret"
-  name  = "ci/infra"
-}
-
 data "vault_kv_secret_v2" "viktor_secrets" {
   mount = "secret"
   name  = "viktor"
@@ -85,18 +80,6 @@ resource "kubernetes_manifest" "external_secret" {
   depends_on = [kubernetes_namespace.claude_agent]
 }
 
-# SSH key for git operations (kept for fallback)
-resource "kubernetes_secret" "ssh_key" {
-  metadata {
-    name      = "ssh-key"
-    namespace = kubernetes_namespace.claude_agent.metadata[0].name
-  }
-  data = {
-    "id_rsa" = data.vault_kv_secret_v2.ci_secrets.data["devvm_ssh_key"]
-  }
-  type = "Opaque"
-}
-
 # SOPS age key for terraform state decryption
 resource "kubernetes_secret" "sops_age_key" {
   metadata {