⚠️ Rename rossocortex → cortex + clean residual kagenti refs

Follow-up to the Rossoctl rename: #485 merged the rename + go.sum fixes but not the
later rossocortex→cortex change, and .claude/skills files that landed on main after
the branch still referenced kagenti.

- rossocortex → cortex (19 files): token-broker require
  github.com/rossoctl/rossocortex/authbridge/authlib → .../cortex/...; webhook image
  defaults + e2e ghcr.io/rossoctl/rossocortex/* → ghcr.io/rossoctl/cortex/*
- Residual kagenti → rossoctl in .claude/skills (9 files): /tmp/kagenti/* →
  /tmp/rossoctl/*, kagenti-operator-controller-manager →
  rossoctl-operator-controller-manager, Kagenti brand

Verification: go build ✅, go vet ✅, internal/webhook/config test ✅; git grep clean
of kagenti and rossocortex. token-broker depends on
github.com/rossoctl/cortex/authbridge/authlib, which resolves once cortex #680 merges
and its authlib module publishes under the cortex path.

Related to #1972

Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: IBRAHIM IBRAHIM <66755652+Ibrahim2595@users.noreply.github.com>

Author: Ibrahim2595

.claude/skills/orchestrate/SKILL.md

@@ -63,15 +63,15 @@ What was provided?
 
 ### Route logic
 
-1. **`/orchestrate <repo-path>`** -- If the path points to a git repository, derive the target name from the directory basename. Check `/tmp/kagenti/orchestrate/<target>/` for existing state. If no scan report exists, invoke `orchestrate:scan`. If scan exists but no plan, invoke `orchestrate:plan`. If both exist, determine the next incomplete phase and invoke it.
+1. **`/orchestrate <repo-path>`** -- If the path points to a git repository, derive the target name from the directory basename. Check `/tmp/rossoctl/orchestrate/<target>/` for existing state. If no scan report exists, invoke `orchestrate:scan`. If scan exists but no plan, invoke `orchestrate:plan`. If both exist, determine the next incomplete phase and invoke it.
 
 2. **`/orchestrate <phase>`** -- Validate that `scan-report.md` and `plan.md` exist for the current target. If missing, instruct the user to run `/orchestrate <repo-path>` first. Otherwise invoke the requested phase skill directly (e.g., `orchestrate:precommit`).
 
-3. **`/orchestrate status`** -- List all directories under `/tmp/kagenti/orchestrate/`, read each target's `phase-status.md`, and display a summary table showing target name, current phase, and completion percentage.
+3. **`/orchestrate status`** -- List all directories under `/tmp/rossoctl/orchestrate/`, read each target's `phase-status.md`, and display a summary table showing target name, current phase, and completion percentage.
 
 ## Phase Status Tracking
 
-All orchestration state is persisted under `/tmp/kagenti/orchestrate/<target>/`:
+All orchestration state is persisted under `/tmp/rossoctl/orchestrate/<target>/`:
 
 | File | Purpose |
 |------|---------|
@@ -154,5 +154,5 @@ git clone git@github.com:org/repo.git .repos/repo-name
 
 | Skill | Description |
 |-------|-------------|
-| `onboard:link` | Link a newly-orchestrated repo to Kagenti |
+| `onboard:link` | Link a newly-orchestrated repo to Rossoctl |
 | `onboard:standards` | Apply organizational standards and conventions |

.claude/skills/orchestrate:ci/SKILL.md

@@ -39,8 +39,8 @@ security scanning, dependency management, and supply chain hardening.
 
 ## Prerequisites
 
-- Plan exists at `/tmp/kagenti/orchestrate/<target>/plan.md`
-- Scan report at `/tmp/kagenti/orchestrate/<target>/scan-report.md`
+- Plan exists at `/tmp/rossoctl/orchestrate/<target>/plan.md`
+- Scan report at `/tmp/rossoctl/orchestrate/<target>/scan-report.md`
 - Target repo in `.repos/<target>/`
 
 ## Read Scan Report First
@@ -402,7 +402,7 @@ gh pr create --repo org/repo --title "Add comprehensive CI workflows" --body "Ph
 
 ## Update Phase Status
 
-Set ci to `complete` in `/tmp/kagenti/orchestrate/<target>/phase-status.md`.
+Set ci to `complete` in `/tmp/rossoctl/orchestrate/<target>/phase-status.md`.
 
 ## Related Skills
 

.claude/skills/orchestrate:plan/SKILL.md

@@ -33,7 +33,7 @@ is Phase 1 — interactive brainstorming with the developer, no PRs.
 Scan report must exist:
 
 ```bash
-cat /tmp/kagenti/orchestrate/<target>/scan-report.md
+cat /tmp/rossoctl/orchestrate/<target>/scan-report.md
 ```
 
 ## Planning Process
@@ -78,7 +78,7 @@ Target 600-700 lines per PR. For each phase:
 
 ## Plan Output
 
-Save to `/tmp/kagenti/orchestrate/<target>/plan.md`:
+Save to `/tmp/rossoctl/orchestrate/<target>/plan.md`:
 
 ```markdown
 # Enhancement Plan: <target>
@@ -128,7 +128,7 @@ Save to `/tmp/kagenti/orchestrate/<target>/plan.md`:
 Initialize phase tracking:
 
 ```bash
-cat > /tmp/kagenti/orchestrate/<target>/phase-status.md << 'EOF'
+cat > /tmp/rossoctl/orchestrate/<target>/phase-status.md << 'EOF'
 # Phase Status: <target>
 
 | Phase | Status | PR | Date |

.claude/skills/orchestrate:precommit/SKILL.md

@@ -35,7 +35,7 @@ produces PR #1 — the foundation that validates all subsequent PRs.
 
 ## Prerequisites
 
-- Plan exists at `/tmp/kagenti/orchestrate/<target>/plan.md`
+- Plan exists at `/tmp/rossoctl/orchestrate/<target>/plan.md`
 - Target repo cloned in `.repos/<target>/`
 
 ## Step 1: Detect Language
@@ -212,7 +212,7 @@ gh pr create --repo org/repo --title "Add pre-commit hooks and code quality base
 
 ## Update Phase Status
 
-Update `/tmp/kagenti/orchestrate/<target>/phase-status.md`:
+Update `/tmp/rossoctl/orchestrate/<target>/phase-status.md`:
 - Set precommit to `complete`
 - Record PR number and date
 

.claude/skills/orchestrate:review/SKILL.md

@@ -37,7 +37,7 @@ submits reviews after user approval.
 
 ## Prerequisites
 
-- `scan-report.md` and `plan.md` exist in `/tmp/kagenti/orchestrate/<target>/`
+- `scan-report.md` and `plan.md` exist in `/tmp/rossoctl/orchestrate/<target>/`
 - Phases 2-6 are complete (or at least the phases that were planned)
 - PRs are open on the target repo
 
@@ -210,7 +210,7 @@ Update `phase-status.md` when complete:
 
 ```bash
 # Update phase-status.md
-sed -i '' 's/| review .*/| review | complete | -- | YYYY-MM-DD |/' /tmp/kagenti/orchestrate/<target>/phase-status.md
+sed -i '' 's/| review .*/| review | complete | -- | YYYY-MM-DD |/' /tmp/rossoctl/orchestrate/<target>/phase-status.md
 ```
 
 ## Related Skills

.claude/skills/orchestrate:scan/SKILL.md

@@ -277,7 +277,7 @@ Then follow the `cve:scan` skill workflow:
    Advisory Database
 4. **Classify** — confirmed / suspected / false positive
 
-Write CVE findings to `/tmp/kagenti/cve/<target>/scan-report.json` (never to
+Write CVE findings to `/tmp/rossoctl/cve/<target>/scan-report.json` (never to
 git-tracked files). Include a summary in the scan report.
 
 Key areas to focus on:
@@ -326,10 +326,10 @@ git -C .repos/<target> remote -v
 
 ## Output Format
 
-Save scan report to `/tmp/kagenti/orchestrate/<target>/scan-report.md`:
+Save scan report to `/tmp/rossoctl/orchestrate/<target>/scan-report.md`:
 
 ```bash
-mkdir -p /tmp/kagenti/orchestrate/<target>
+mkdir -p /tmp/rossoctl/orchestrate/<target>
 ```
 
 Report template:
@@ -439,7 +439,7 @@ Report template:
 
 ## Dependency Vulnerabilities (cve:scan)
 - Scan method: [Trivy + LLM + WebSearch / LLM + WebSearch / LLM only]
-- Full report: `/tmp/kagenti/cve/<target>/scan-report.json`
+- Full report: `/tmp/rossoctl/cve/<target>/scan-report.json`
 
 | Severity | Count |
 |----------|-------|
@@ -458,7 +458,7 @@ Report template:
 |---------|----------|---------|
 | [e.g., insecure port, no input validation] | HIGH/MEDIUM | [brief description] |
 
-> **Note:** CVE IDs and detailed descriptions are in `/tmp/kagenti/cve/<target>/scan-report.json` only.
+> **Note:** CVE IDs and detailed descriptions are in `/tmp/rossoctl/cve/<target>/scan-report.json` only.
 > Do NOT copy CVE IDs into git-tracked files, PRs, or issues.
 
 ## Gap Summary

.claude/skills/skills:scan/SKILL.md

@@ -180,10 +180,10 @@ Rate each skill 1-5:
 
 ### Phase 6: Generate Report
 
-Save to `/tmp/kagenti/skills-scan/`:
+Save to `/tmp/rossoctl/skills-scan/`:
 
 ```bash
-mkdir -p /tmp/kagenti/skills-scan
+mkdir -p /tmp/rossoctl/skills-scan
 ```
 
 Output a structured report:

.claude/skills/skills:validate/SKILL.md

@@ -60,18 +60,18 @@ Commands target local Kind clusters or test environments.
 
 Check pod status:
 ```bash
-kubectl get pods -n kagenti-system
+kubectl get pods -n rossoctl-system
 ```
 
 Check logs:
 ```bash
-kubectl logs -n kagenti-system deployment/kagenti-operator-controller-manager
+kubectl logs -n rossoctl-system deployment/rossoctl-operator-controller-manager
 ```
 
 ## BAD (chained commands won't match auto-approve patterns)
 
 ```bash
-kubectl get pods -n kagenti-system && kubectl logs -n kagenti-system deployment/kagenti-operator-controller-manager
+kubectl get pods -n rossoctl-system && kubectl logs -n rossoctl-system deployment/rossoctl-operator-controller-manager
 ```
 ```
 

.claude/skills/skills:write/SKILL.md

@@ -100,12 +100,12 @@ Claude Code auto-approves commands by matching the first token against `.claude/
 ```markdown
 Check pod status:
 ```bash
-kubectl get pods -n kagenti-system
+kubectl get pods -n rossoctl-system
 ```
 
 Check logs:
 ```bash
-kubectl logs -n kagenti-system deployment/kagenti-operator-controller-manager
+kubectl logs -n rossoctl-system deployment/rossoctl-operator-controller-manager
 ```
 ```
 
@@ -117,10 +117,10 @@ Commands targeting management clusters or AWS need user approval anyway, so mult
 
 ### Temporary Files
 
-Skills that download logs, artifacts, or save analysis output should use `/tmp/kagenti-operator/<skill-category>/` as the working directory:
+Skills that download logs, artifacts, or save analysis output should use `/tmp/operator/<skill-category>/` as the working directory:
 
 ```bash
-mkdir -p /tmp/kagenti-operator/rca
+mkdir -p /tmp/operator/rca
 ```
 
 ### Update settings.json

charts/operator/templates/manager/manager.yaml

@@ -193,7 +193,7 @@ spec:
             {{- end }}
         {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
         - name: spiffe-helper
-          image: ghcr.io/rossoctl/rossocortex/spiffe-helper:latest
+          image: ghcr.io/rossoctl/cortex/spiffe-helper:latest
           imagePullPolicy: IfNotPresent
           args:
             - "-config"