Rename wave R4: wire, stored names

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child K4 — `skynet` → `jaah` rename, wave R4 (architecture §1.8). Follows wave R3. Rename campaign rules (architecture §1.8, verbatim kernels): `tools/name_residue.toml` is the inventory. Each wave removes whole `[[kept]]` categories (or K7 rows), the matching rows of `apps/jaahd/README.md` §"Legacy names still served", and the matching `sensitive_baseline` rows (if B has merged). Its gate (`tools/check_name_residue.py`) proves nothing re-enters. Each wave ships behind dual-accept: the new name is primary and the old one is still served. The next wave starts only when the console's node census, on both dev and prod, shows every node on a release at or above the previous wave. Prod moves when the operator promotes to master (A6) — this runner never promotes to master. Precondition for every wave after R1: the console census on BOTH dev and prod shows every node on the previous wave's release. If prod is not there yet, ASK one round (header `Human act`: promote the previous wave to master) and do not merge this wave until the census holds. Never merge two waves ahead of prod. Preserving work in progress (A6): a wave that touches node paths or accounts runs inside the package's postinst under a drain (node reports `draining`, CP stops leasing, runners get the existing interrupt, worktree and session state stay on disk, the CP relaunches each interrupted runner into the same worktree). Removes (verbatim): "Wire and stored names. `skynet.*.v<N>` MAC labels go through a dual-accept migration: the CP and nodes accept both, emit the new label, and the old one is dropped next release. The stored names `skynet-fleet-` hook prefix, `skynet_openai_api_key` provider id and `skynet_node_token` redaction label are matched by both, then dropped. Also the Android channel `skynet_keep_alive` (create `jaah_keep_alive`, delete the old one in-app), the registry asset id `skynet-paths-py` (an engine lock migration), and the Azure DevOps basic-auth username." If dropping the old label in the same release would break a node not yet upgraded, ship the dual-accept here and record the drop as a K7 row that K6 removes. Credentials & reach: - AC4 / AC6 / AC8 console flows on dev; node census on dev | `me/jaah/debug/main/operator-login` (operator; switches tenants), `https://app.dev.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - Node census on prod (rename waves R3/R5, A6) | the same credential, `https://app.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a Out of scope: - Do NOT touch AWS/GitHub names (R5) or alembic history text (R6). No alembic migration in this child (D owns this wave's migration): stored ids are matched by both names in code. Do NOT promote to master. - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. - Do NOT write to any mirror repo before the final publish child (A5). Done means: - This wave's `[[kept]]` entries/rows are deleted from `tools/name_residue.toml` and `tools/check_name_residue.py` passes — run it and cite output. - `./dc check full` is green (merge lane) and the dev deploy (Jaah Deploy) of the merged PR is green. - Before merge: the dev and prod census shows every node on the previous wave's release (cite both). - After merge: the console node census on dev (Machines, as operator) shows every node on the release carrying wave R4, with no interrupted task lost (each relaunched into its own worktree) — cite the census and any relaunched task ids. Prod census on this wave's release follows the operator's master promotion and is the next wave's precondition. - Tests prove the CP and node accept both MAC label spellings and emit the new one.