refactor: de-vendor foreign services and retire claim-forge + cicd-hyper-a

[hyperpolymath]

What & why

OPSM used to build 9 satellite service images and push them to ghcr.io/hyperpolymath/<svc>. Because docker/metadata-action stamps org.opencontainers.image.source with the building repo, GitHub linked all of those GHCR packages to OPSM — even the ones that belong to other repos or are private/dead. This PR removes three services that should never have been built/published here and stops OPSM publishing any satellite images; each real owner now publishes its own correctly-attributed image (separate PRs in stapeln, svalinn, checky-monkey, palimpsest-license, oikosbot).

This combines the de-vendor, the Elixir core retirement, and the cerro-torre removal into one coherent change (one branch per repo).

De-vendor (delete vendored sources + every reference)

Service	Disposition
claim-forge	private code that should not have been public — deleted
cicd-hyper-a	retired (the live project is the separate hypatia repo) — removed entirely, not integrated
cerro-torre	belongs to hyperpolymath/stapeln, not for release — deleted

services/{claim-forge,cicd-hyper-a,cerro-torre}/ are deleted and .github/workflows/trust-pipeline-images.yml is retired (cerro-torre was its last matrix entry → OPSM now publishes no satellite images at all).

Elixir core retirement (claim_forge + cicd_hyper_a)

• Deleted the ClaimForge and CicdHyperA client modules.
• config.ex: dropped both service fields, default ports (7001, 7004), parser clauses and example config.
• types.ex: removed both OpsmConfig fields, the cicd publish/federation types (SyncState, FederationStatus, CicdPublishRequest/Response) and the claim-forge types (claim_type, ClaimForgeRequest/Response); dropped :claim_forge from attestation_type (kept :sigstore | :in_toto and AttestationRef, still used by ResolvedPackage + the SLSA check).
• wiring.ex: removed the claim-forge attestation stage and the cicd-hyper-a publish stage; run_publish is now ingest → license (palimpsest) → sustainability (oikos) → validate → checky-monkey.
• events.ex: genericised the federation event dispatcher off CicdHyperA (it only ever simulated a response).
• trust/pipeline.ex: dropped the claim-forge SPDX step from verify_for_publish; errors.ex: dropped the two *_unavailable severities; cli.ex/container.ex: doc/help text.
• Updated config_test, pipeline_test, e2e_test, trust_pipeline_test and the live-service e2e test.

Proof: mix compile --warnings-as-errors is clean for all changed modules, and mix test is green — the only failure is an unrelated, pre-existing network test (hyperpolymath_forge_test) that reaches api.github.com and gets a 401 in a sandbox with no token.

Also scrubbed

ReScript/OCaml CLI mirrors (cli/, lib/ocaml/), opsm.toml, the groove manifest, stapeln.toml, selur-compose.yml + deploy/ compose/k8s, the trust-pipeline-e2e workflow, the A2ML metadata (STATE/ECOSYSTEM/META), opsm_mobile/api/package_controller.ex, and the docs. Verified: no residual references remain (only a couple of explicit "service removed" comments + a CHANGELOG entry); opsm.toml/stapeln.toml parse as TOML and the groove manifest parses as JSON.

Pre-existing, out of scope: selur-compose.yml / k8s files use // (not #) for their line-2 copyright comment, which strict YAML parsers reject — unchanged by this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_012kWck3NjBo5orHKAXMHm5W

---

Generated by Claude Code