Rename wave R5: AWS and GitHub

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child K5 — `skynet` → `jaah` rename, wave R5 (architecture §1.8, risk 2). Follows wave R4. Rename campaign rules (architecture §1.8, verbatim kernels): `tools/name_residue.toml` is the inventory. Each wave removes whole `[[kept]]` categories (or K7 rows), the matching rows of `apps/jaahd/README.md` §"Legacy names still served", and the matching `sensitive_baseline` rows (if B has merged). Its gate (`tools/check_name_residue.py`) proves nothing re-enters. Each wave ships behind dual-accept: the new name is primary and the old one is still served. The next wave starts only when the console's node census, on both dev and prod, shows every node on a release at or above the previous wave. Prod moves when the operator promotes to master (A6) — this runner never promotes to master. Precondition for every wave after R1: the console census on BOTH dev and prod shows every node on the previous wave's release. If prod is not there yet, ASK one round (header `Human act`: promote the previous wave to master) and do not merge this wave until the census holds. Never merge two waves ahead of prod. Removes (verbatim): "AWS and GitHub residue (K4, K5). Bootstrap `name_prefix` changes to `jaah` through `terraform state mv` and `moved {}` blocks; the S3 state bucket is migrated by a copy and a backend switch. Plan before apply, every apply through `jaah-bootstrap-apply.yml`. OIDC trust first accepts both workflow paths and both environment names, then the files and environments are renamed (`skynetd-publish` → `jaahd-publish`; `jaahd-publish` already exists), the secret `SKYNET_APT_GPG_PRIVATE_KEY` becomes `JAAH_APT_GPG_PRIVATE_KEY`, and the old trust is dropped. Metric namespace `Skynet/<env>`, SSM `/skynet/<env>/…`, ALB name prefixes. The `skynet-host` runner label is dropped (`jaah-host` is already registered)." Context: `infra/jaah/terraform/bootstrap/bootstrap.tfvars:3` has `name_prefix = "skynet"`; workloads (`environments/dev/dev.jaah.tfvars:9`) are already `jaah`. Mitigation (verbatim): "dual trust before renaming files; `moved {}` and `state mv` only, never destroy/create; plan reviewed before every apply. The S3 backend switch uses `terraform init -migrate-state`." Split into several PRs (dual trust → rename → drop old trust). Never `-auto-approve` outside the apply workflow; never paste state output. Credentials & reach: - K5: AWS bootstrap rename | applied through `.github/workflows/jaah-bootstrap-apply.yml` (OIDC, environment `bootstrap`); read-side checks with `me/jaah/system/bootstrap-admin` | **verified**: `credential_get` succeeded; `sts.amazonaws.com` reachable (302); the `bootstrap` environment exists in `jaah-ai/jaah` - AC4 / AC6 / AC8 console flows on dev; node census on dev | `me/jaah/debug/main/operator-login` (operator; switches tenants), `https://app.dev.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - Node census on prod (rename waves R3/R5, A6) | the same credential, `https://app.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a Out of scope: - Do NOT destroy/recreate any AWS resource (a plan showing destroy of a stateful resource blocks the apply). Do NOT touch alembic history (R6). Do NOT promote to master. - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. - Do NOT write to any mirror repo before the final publish child (A5). Done means: - This wave's `[[kept]]` entries/rows are deleted from `tools/name_residue.toml` and `tools/check_name_residue.py` passes — run it and cite output. - `./dc check full` is green (merge lane) and the dev deploy (Jaah Deploy) of the merged PR is green. - Before merge: the dev and prod census shows every node on the previous wave's release (cite both). - After merge: the console node census on dev (Machines, as operator) shows every node on the release carrying wave R5, with no interrupted task lost — cite the census. Prod census on this wave's release follows the operator's master promotion and is the next wave's precondition. - Every bootstrap `terraform plan` shows only moves/in-place updates, no destroy of stateful resources — cite plan summary lines (no state values). - After the trust switch, deploy and publish workflows succeed from the renamed files/environments (cite run ids); `grep -rn skynet infra/jaah .github` returns only rows still kept for R6. - Prod: after the operator's master promotion, the prod deploy and publish workflows run green from the renamed files/environments — ASK (`Human act`) for the promotion and verify it before settling.