[HAR.40] Retire arcforges-ai-hello: remove the main-push deploy, add a dry-run-first retirement dispatch (cleanup 5.2)

[deku2026]

Cleanup 5.2 (user authorization of 2026-10-10, quoted verbatim in the coordinator brief, section 0d): retire the replaced AI Worker arcforges-ai-hello (Workflow arcforges-ai-hello, binding HELLO_AGENT, class HelloAgentWorkflow). The HAR.40 C# Harness in Cloud (#80) replaces it.

Claim: HAR.40 epoch 2 (w-deku-20261010-har-40)

Changes

• ci.yml: removes the main-push deploy job and the deployment-verification job that depended on it. validate, quality, codeql, dependencies, candidate and verify are unchanged, and Verify stays the only required check. After this merge, no push to main deploys the Worker.
• New retire-cloudflare.yml:
  • Trigger and access: workflow_dispatch only, main only, environment cloudflare, contents: read; inputs pass through env.
  • Default: mode is dry-run. A dry run sends only GET requests and writes plan.json.
  • The plan refuses while any non-terminal Workflow instance exists, while any status is unknown, while any paged list comes back full, or inside the seven-day drain horizon.
  • Delete mode needs mode=delete plus the exact confirm string delete arcforges-ai-hello, checked before any network call. It re-runs the plan, deletes the Workflow, then the script (without force), verifies 404 on both, and writes result.json.
• eng/retire.mjs and eng/tests/retire.test.mjs: 21 tests with a fake fetcher cover every branch, the endpoint allowlist, and a check that no secret appears in output.
• eng/cloudflare.mjs: exports credentials, and deploy() now refuses.
• Status docs (AGENTS.md, docs/deploying.md, README.md, docs/development.md): retirement in progress and deletion pending, changing to retired only after the delete run verifies 404.
• ADP-07 supporting files: eng/policy/dependency-reviews/har-40-r2.json, a successor of har-40-r1 (only the ci.yml digest and rationale change; packages identical); eng/policy/dependency-policy.json (the ci.yml binding and the review pointer); eng/provenance/files.json (new rows).
• Untouched: wrangler.json, package.json, package-lock.json and .node-version. They are dependency inputs, and DesktopPlatform's SI-08 rule reads the wrangler workflows block. Every ai-* release, tag, deployment record, the evidence and the provenance are kept.

Authority and planning

• The write scope comes from coordinator ruling S57(17), carried by planning repair fix8 (Design/Plan, P2-026 item 20). This PR merges only after fix8.
• The replacement was checked read-only first: production /api/healthz returned 200 with the revision at Cloud main and nativeAot true. Live Proof 1 cannot run, because the proof environment has no AI binding. It is recorded as "not proven", per the user's 5.2 text.
• The live dispatch (dry run, then delete) is done by the coordinator after the merge. The run ids go into the Plan HAR.40 ledger.

Validation (local, under CI conditions; hosted CI is authoritative)

• Simulated PR merge in a fresh clone: npm ci, npm run check, which covers dependency, architecture and repository checks, prettier, biome, tsc, vitest (157) and tooling (70).
• npm audit: 0. actionlint 1.7.12: clean. gitleaks (pinned image, WSL Docker, full history): 0.
• Candidate build and verify:candidate passed. retire.test.mjs: 21/21.

Merge with a merge commit, keeping the three commits together.

🤖 Generated with Claude Code

[deku2026]

Independent review record: HAR.40 epoch 2 (cleanup 5.2 retirement PR). Reviewer w-deku-20261010-rev-har-40 (Opus 5.5), an independent session that authored nothing.

Reviewed 600abae for [HAR.40] epoch 2: approved.

• Scope: every path is inside the S57(17) AI writes or is a justified ADP-07 receipt file. wrangler.json, package.json, package-lock.json and .node-version are byte-identical to main.
• The receipt chain is append-only: har-40-r2 supersedes har-40-r1, and its packages are identical. The S25 reviewer field names this session.
• ci.yml: only the deploy and deployment-verification jobs are removed, and Verify still needs [validate, quality, codeql, dependencies, candidate].
• The status docs say "retirement in progress; deletion pending" until the delete run verifies 404.
• Gates, re-run on a simulated PR merge in a fresh clone under CI conditions with Node 24.21/npm 11.19: npm ci, check (157 vitest and 70 tooling tests), audit 0, actionlint clean, gitleaks 0, candidate build and verify, retire tests 21/21.

Non-blocking:

• The runtime refusal string and one workflow step name say "retired". They can be reworded in the post-deletion follow-up.
• PR CI does not run retire.test.mjs; it runs as the first step of the dispatch workflow.
• Stale deployment text remains outside the writes (docs/provenance.md:25, :29; docs/dependency-policy.md:11), for a documentation follow-up.
• Merge after fix8, with a merge commit.