ci: stop publishing oikos and claim-forge images (#57)

## Why

Follow-up to #50. Two more services were still built and pushed (now
also with build-provenance attestations from #55) under odds-and-sods,
mis-attributing their GHCR packages:

- **`oikos`** → belongs to **`hyperpolymath/oikosbot`**; the package
should be relinked there.
- **`claim-forge`** → part of a private system; it must not be published
as a public OPSM package (its source `services/claim-forge/` is also
public in this repo — see "open items").

`docker/metadata-action` injects `org.opencontainers.image.source` from
the repo running the build, so anything built here links to
odds-and-sods regardless of where it really belongs.

## What

Removes `oikos` and `claim-forge` from the `trust-pipeline-images` build
matrix. **`cerro-torre`** is now the only service still built here —
flagged in-file pending confirmation it has no upstream/private home of
its own.

This is self-contained: `trust-pipeline-e2e.yml` *pulls* these images
(it doesn't depend on the build job), so trimming the matrix doesn't
break e2e.

## Manual GHCR steps (API can't do these)

- `oikos`: Package → settings → unlink (🗑) → relink to `oikosbot`.
- `claim-forge`: delete the public package (and decide on the public
source — see below).

## Open items / follow-ups

- **claim-forge privacy** — `services/claim-forge/` is a real 229-line
public Rust service in this public repo. If it's meant to be private,
the *source* needs removing too, not just the package.
- **cerro-torre** — confirm whether it's OPSM-native (keep building) or
someone else's/private (remove).
- **Deletion coupling** — `oikos`/`claim-forge`/`cicd-hyper-a` are still
referenced by `trust-pipeline-e2e.yml`, `selur-compose.yml` and OPSM
core. Deleting the `claim-forge`/`cicd-hyper-a` packages needs a
separate pass to strip those references first, or e2e CI will fail to
pull them.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01J88oVkzkSn8DyHx3zxKeXS

---
_Generated by [Claude
Code](https://claude.ai/code/session_01J88oVkzkSn8DyHx3zxKeXS)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/trust-pipeline-images.yml

@@ -10,15 +10,17 @@
 # which is why building a foreign service here silently mis-attributed it to
 # odds-and-sods-package-manager.)
 #
-# Built elsewhere (do NOT add back here):
+# Built / published elsewhere (do NOT add back here):
 #   selur, vordr            -> hyperpolymath/stapeln
 #   checky-monkey           -> hyperpolymath/checky-monkey
 #   palimpsest-license      -> hyperpolymath/palimpsest-license
 #   svalinn                 -> hyperpolymath/svalinn
-#   cicd-hyper-a            -> retired name (project is hyperpolymath/hypatia); not published
+#   oikos                   -> hyperpolymath/oikosbot
+#   cicd-hyper-a            -> retired; no longer exists, GHCR package to be deleted
+#   claim-forge             -> owner's private system; must not be published publicly here
 #
-# OPSM-native services built here (no separate upstream repo):
-#   claim-forge, oikos, cerro-torre
+# OPSM-native service(s) built here:
+#   cerro-torre   (pending confirmation it has no upstream/private home of its own)
 
 name: Trust Pipeline Images
 on:
@@ -45,13 +47,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # OPSM-native services only (no upstream repo of their own).
-          # Services with their own repo (selur, vordr -> stapeln, checky-monkey,
-          # palimpsest-license, svalinn) publish their own images so each GHCR
-          # package links to the correct source repository. cicd-hyper-a is a
-          # retired name (now hyperpolymath/hypatia) and is no longer published.
-          - service: claim-forge
-          - service: oikos
+          # OPSM-native services only. Anything with its own repo or that belongs
+          # to a private system is published by its owner, so each GHCR package
+          # links to the correct source: selur/vordr -> stapeln, checky-monkey,
+          # palimpsest-license, svalinn, oikos -> oikosbot. cicd-hyper-a is
+          # retired; claim-forge belongs to a private system. cerro-torre is the
+          # only one still built here, pending confirmation it has no other home.
           - service: cerro-torre
     steps:
       - name: Checkout