fix: correct tanko runtime to DSH across contracts & scripts

Tanko migrated from Hermes to DSH (DeepSeek Harness) on 2026-08-27. Update all
records that described tanko as a Hermes agent / Hermes runtime:

- infra-control: CT 112 tanko platform Hermes -> DSH
- zulip-health / zulip-self-heal / zulip-mention-reliability / pi-approval:
  tanko is on DSH, mumuni remains on Hermes
- memory-audit-maintenance: exclude tanko from Hermes roster (uses DSH-native memory)
- hermes-config-template / hermes-agent-baseline: remove tanko from Hermes roster,
  keep LiteLLM key alias 'tanko'
- hermes-zulip-plugin / hermes-zulip-restore / build-zulip-plugin: tanko excluded
- infrastructure-maintenance: gateways check no longer probes Hermes on tanko CT112
- scripts/daily-infra-report.py: fix CT-ID regression (CT 122->112), report tanko as DSH
- scripts/zulip-monitor.sh: stop probing tanko's retired Hermes gateway
- scripts/agent-health-check.py: skip Hermes gateway checks for tanko (runtime=dsh)
- scripts/prose-auth-check.sh + AGENTS.md: authorize tanko/tanko-bot for its own records

Tanko remains CT 112 at 192.168.68.122; infrastructure facts unchanged.
Dated/incident records (run logs, migration logs) left intact as history.

scripts/agent-health-check.py

@@ -337,10 +337,6 @@ def check_ct_liveness():
 def check_config_integrity():
     """Verify agent config.yaml parses as valid YAML."""
     for name, agent in AGENTS.items():
-        # Tanko runs on DSH (DeepSeek Harness) since 2026-08-27 — no Hermes config.yaml.
-        if agent.get("runtime") == "dsh":
-            print(f"  ⏭️ {name}: DSH — no Hermes config.yaml since 2026-08-27")
-            continue
         host = agent.get("host")
         user = agent.get("user")
         if not host or not user:
@@ -370,10 +366,6 @@ def check_config_integrity():
 def check_wrapper_integrity():
     """Verify the hermes CLI wrapper exists and can reach hermes-real."""
     for name, agent in AGENTS.items():
-        # Tanko runs on DSH (DeepSeek Harness) since 2026-08-27 — no hermes CLI wrapper.
-        if agent.get("runtime") == "dsh":
-            print(f"  ⏭️ {name}: DSH — no hermes CLI wrapper since 2026-08-27")
-            continue
         host = agent.get("host")
         user = agent.get("user")
         if not host or not user:

scripts/prose-auth-check.sh

@@ -12,7 +12,7 @@ echo ""
 # Authorized agents for restricted contracts
 # Format: contract_pattern|authorized_agents (comma-separated)
 declare -A RESTRICTED
-RESTRICTED["infrastructure-control.prose.md"]="abiba,abiba-bot,tanko,tanko-bot,mumuni,mumuni-bot"
+RESTRICTED["infrastructure-control.prose.md"]="abiba,abiba-bot,tanko,tanko-bot"
 RESTRICTED["proxmox-monitor.prose.md"]="abiba,abiba-bot"
 RESTRICTED["hermes-config-template.prose.md"]="abiba,abiba-bot,mumuni,mumuni-bot,tanko,tanko-bot"
 RESTRICTED["zulip-health.prose.md"]="abiba,abiba-bot,mumuni,mumuni-bot,tanko,tanko-bot"