refactor(template): match single-harness (hyperguild) architecture (infra#178)

The template carried the old multi-tool/agentsquad-era CAD-executor scaffold.
Refresh it to the consolidated single-harness reality (hyperguild#75/#76):
Claude Code + hyperguild, session-based, brain + gitea MCP. No dispatch
automation added (out of scope — dispatch stays manual until real friction
warrants it).

Removed (multi-tool + dead generator + deployed-agent-era):
- .aider.conf.yml, .aider.conventions.md, .cursorrules
- .context/ (mcp.json, PROJECT.md, system-prompt.txt)
- agent-policy.yaml (k8s NetworkPolicy scaffold)
- scripts/context-sync.sh (generated the above from .context/PROJECT.md — now
  input-less) + its context:sync* Taskfile tasks

Added / updated:
- .mcp.json (root, hyperguild-shaped: brain + gitea, Bearer env tokens)
- CLAUDE.md / AGENTS.md / README.md → single-harness workflow (issue →
  hyperguild session → PR → report-back comment → brain capture)
- AGENT_BOUNDARIES.md kept (harness-agnostic egress/scope guidance); repointed
  its two references to the removed agent-policy.yaml

Left alone: cd.yml, Dockerfile, Taskfile (build/test), go.mod, cmd/, internal/,
pkg/, .claude/. No dangling refs to removed files (verified). Refs infra#178.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AGENT_BOUNDARIES.md

@@ -22,7 +22,9 @@ Egress MUST be blocked to:
 - Public package registries from runtime (proxy through build only)
 - Customer/client domains not listed in the engagement scope
 
-Add new endpoints by editing `agent-policy.yaml` AND this table in the same commit.
+Add new endpoints by editing this table in the same commit that wires them, and enforce them
+with whatever egress mechanism the deployment uses (e.g. a k8s NetworkPolicy in the project's
+own deploy manifests).
 
 ## File scope
 
@@ -68,7 +70,7 @@ The agent MUST NOT, without explicit opt-in in code review:
 
 ## Review triggers
 
-Bump this doc + `agent-policy.yaml` when:
+Bump this doc (and the deployment's egress enforcement) when:
 
 - A new external endpoint is added
 - A new tool with side effects is wired in