docs(power): reclaim the sleep docs from the sold box; fix AGENTS.md machine facts

The sleep/wake saga (Alienware-M16a2 research + Sleep-Fix-Guide) framed a
machine sold on 2026-09-28 as 'this system' — the 2026-09-28 identifier
purge missed both because they name no hostname. blankpad probed live:
Lenovo, AMD Ryzen 5 PRO 5650U / Cezanne, unified memory, s2idle only,
no NVIDIA, no ~/GitPackages/llama.cpp.

- research/Sleep-Fix-Guide.md -> .AGENTTRASH (verbatim restatement of the
  research doc's fix steps; PowerCluster overlap census)
- Alienware doc: archive banner, 'this system' -> retired dankware
- linux-power-management.md: scope note (blankpad s2idle-only; NVIDIA
  section is dankware/future-NVIDIA territory), boilerplate AGENTS.md
  cross-ref dropped
- cachyos.md: de-pinned rolling-release kernel versions (7.1.4 doc vs
  7.2.9 live), repo list confirmed verbatim against pacman.conf, SDDM
  confirmed live, verified: 2026-10-19
- AGENTS.md: dev-workstation row rewritten for blankpad; Gitea gotcha
  corrected — remote URLs carry NO token (credential-store file, verified)

Refs #29

AGENTS.md

@@ -100,15 +100,18 @@ secret in every agent's context window on every machine that pulls this repo.
 
 | box | role | GPU | notes |
 |-----|------|-----|-------|
-| Dev workstation | client box, never runs inference | laptop iGPU + dGPU (non-unified) | mainline llama.cpp at `~/GitPackages/llama.cpp/build/bin/`; this repo lives here at `~/.omp` |
+| Dev workstation (`blankpad`) | client box, never runs inference | Lenovo laptop, AMD Ryzen 5 PRO 5650U / Cezanne APU (**unified memory**, s2idle sleep only, no dGPU) | this repo lives here at `~/.omp`; the earlier "iGPU + dGPU / `~/GitPackages/llama.cpp`" description belonged to the sold `dankware` box |
 | Dankclaw | bench target, secondary models + service stack | Strix Halo APU (**unified memory**) + RTX 3090 (moved over from Dankserver 2026-09) | prod services `frank-dragoon` (halogen-flash-server, :7770, iGPU) and `frank-zealot` (llama.cpp PrismML fork, :7771, 3090); runbooks in the serverAppConfigs vault (`~/Projects/serverAppConfig/serverAppConfigs-docs/LLM/`); ssh: `ssh dankclaw` |
 | Dankserver | main-model box | 2× Radeon AI PRO R9700 — non-unified (was RTX 3090 until 2026-09) | runs `frank-archon` (radiance, TP=2, :7770) — **this repo's operator session runs on it**; ssh: `ssh dankserver` |
 
 ## Environment gotchas
 
 - Gitea API needs a token: `GITEA_TOKEN` env (gitignored `.env`). No `tea` CLI
-  installed anywhere. Remote URLs embed the token locally in `.git/config` — that
-  file is never pushed; it is not a substitute for the secret gate.
+  installed anywhere. Remote URLs carry NO embedded token (2026-10-09
+  credential-store cutover) — git and the API both read
+  `~/.config/secrets/gitea` (`store --file`, URL-line format; see
+  `omp-docs/tools/gitea/client-access.md`). That file is never pushed; it is
+  not a substitute for the secret gate.
 - Passwordless sudo (`sudo -n`) works on Dankclaw and Dankserver for systemctl
   verbs only; user units need no sudo at all.
 - SSH into both servers is BatchMode-capable from here: