fix(alignment): resolve /root/ hardcoding and stale tanko-DSH references

F1: agent-health-check.py now resolves the home directory from the agent's
user field via a shared helper (get_user_home) instead of hardcoding /root/.
This fixes the false-positive wrapper-missing:tanko report — tanko has a
working wrapper at /home/jerome/.local/bin/hermes, but the check was looking
in /root/.local/bin/.

F2: Updated stale references that described tanko as DSH-only:
- hermes-zulip-restore.prose.md: tanko excluded — hybrid (DSH + Hermes)
- hermes-zulip-plugin.prose.md: tanko excluded — hybrid (DSH + Hermes)
- infrastructure-control.prose.md: tanko is hybrid (DSH + Hermes) agent
- docs/probe-drift-round2-evidence.md: marked as historical record with
  dated note explaining that the DSH-only observations reflected the
  /root/ hardcoding bug, not the underlying truth

Refs: fix/agent-health-root-hardcoding-20260928

docs/probe-drift-round2-evidence.md

@@ -1,5 +1,14 @@
 # Probe-drift round 2 — per-leg before/after evidence
 
+> **Historical record** — 2026-09-28: The lines below that describe tanko as
+> "DSH (DeepSeek Harness)" only reflect what the check reported when it was
+> running. Tanko's runtime was later found to be **hybrid (DSH + Hermes)** —
+> the check had a `/root/` hardcoding bug that made it probe the wrong home
+> directory and report `wrapper-missing:tanko` for an agent with a working
+> wrapper. This document records the observed output, not the underlying
+> truth; see `fix/agent-health-root-hardcoding-20260928` for the correction.
+
+
 **Date:** 2026-09-10
 **Worktree (absolute execution path):** `/root/.treehouse/prose-contracts-9ce5f3/3/prose-contracts`
 **Branch:** `fm/probe-drift-round2-20260909`