fix: correct IPs, CT IDs, and key status across all contracts

hermes-key-enforcement.prose.md:
  - Add IP column to verified agents table
  - Fix Tanko status: was using master key via systemd drop-in (not compliant)
  - Add detection query step 2: check systemd drop-ins for master key leaks
  - Add step 3: verify running process env against dedicated key
  - Mark Mumuni, Koby, Koonimo as Unverified (last check was surface-level only)

gpu-fleet.prose.md:
  - Add CT ID column to agent table for cross-reference
  - Fix Abiba IP .24 → .65 (pi agent runs on RA-H OS host)
  - Update Abiba LiteLLM key to match actual models.json key
  - Set Koonimo IP to unknown (was .114 — incorrect per user)
  - Fix pi-specific paths .24 → .65

hermes-config-template.prose.md:
  - Set Koonimo IP to unknown

infrastructure-control.prose.md:
  - Set Koonimo IP to unknown
  - Fix Koonimo CT reference

hermes-key-enforcement.prose.md

@@ -74,12 +74,21 @@ model:
 Run on any Hermes host to detect violations:
 
 ```bash
-grep -rn 'api_key: sk-' /root/.hermes/ \
+# 1. Check config.yaml for hardcoded harness keys
+grep -rn 'api_key: sk-' /home/jerome/.hermes/ \
   --include='config.yaml' \
   | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
+
+# 2. Check systemd drop-ins for master key leaks (2026-07-05: Tanko had this)
+grep -rn 'LITELLM_API_KEY' /home/jerome/.config/systemd/user/ 2>/dev/null
+grep -rn 'LITELLM_API_KEY=sk-litellm-7f96080d' /home/jerome/.config/systemd/ 2>/dev/null
+
+# 3. Verify running process env matches dedicated key
+cat /proc/$(cat /home/jerome/.hermes/gateway.pid | python3 -c "import sys,json; print(json.load(sys.stdin)['pid'])")/environ \
+  | tr '\0' '\n' | grep LITELLM_API_KEY
 ```
 
-If any output — violation. Fix immediately.
+If any output from step 2 — **critical violation** (master key leaked). Fix immediately.
 
 ## Rotation Procedure
 
@@ -117,16 +126,16 @@ litellm_settings:
       purpose: "agent-inference"
 ```
 
-## Verified Agents (2026-07-04 final)
+## Verified Agents (2026-07-05 update)
 
-| Agent | CT | Status | LiteLLM Alias | Key Type | Systemd Source | Last Verified |
-|-------|-----|--------|---------------|----------|----------------|---------------|
-| Tanko | 112 | ✅ Compliant | `tanko` | Dedicated | `/etc/environment` only | 23:00 EDT |
-| Mumuni | 114 | ✅ Compliant | `mumuni` | Dedicated | `/etc/environment` only | 23:00 EDT |
-| Koby | 111 | ✅ Compliant | `koby` | Dedicated | User service + drop-in | 23:00 EDT |
-| Koonimo | 113 | ✅ Compliant | `koonimo` | Dedicated | System service + drop-in | 23:00 EDT |
-| Abiba | 100 | ✅ N/A (pi native) | — | — | — | 23:00 EDT |
-| Kagenz0 | 105 | ❌ DOWN | — | — | — | 19:14 EDT |
+| Agent | CT | IP | LiteLLM Alias | Key | Status | Systemd Source | Last Verified |
+|-------|-----|-----|---------------|-----|--------|----------------|---------------|
+| Tanko | 112 | .122 | `tanko` | `sk-620a05e95a-e93d...` | ✅ Fixed | User drop-in `env.conf` | 19:44 UTC Jul 5 |
+| Mumuni | 114 | .123 | `mumuni` | `sk-XY2aUfvy2BIs6kp1ZPh6VA` | ⚠️ Unverified | `/etc/environment` | 23:00 EDT Jul 4 |
+| Koby | 111 | ? | `koby` | `sk-lDTsWy7H3T19UwUFEN6JSg` | ⚠️ Unverified | User service + drop-in | 23:00 EDT Jul 4 |
+| Koonimo | 113 | ? | `koonimo` | `sk-Prx_vRXYb2VEzDmhPCbNeg` | ⚠️ Unverified | System service + drop-in | 23:00 EDT Jul 4 |
+| Abiba | 100 | .65 | — | — | ✅ N/A (pi native) | — | 19:44 UTC Jul 5 |
+| Kagenz0 | 105 | ? | — | — | ❌ DOWN | — | 19:14 EDT Jul 4 |
 
 ### Systemd Service Pattern (2026-07-04 fix)