docs+units: fix every claim my own changes made false

Retiring dankclaw/compose.yaml and adding alert rules invalidated claims across
the repo, including in the rule file agents read first. Clean cutover includes
the prose.

**Tests that had gone hollow.** Four assertions grepped dankclaw/compose.yaml
for a service name. With the file gone they passed by *absence* — a gate that
can no longer fail. Each now asserts the real invariant ("no dankclaw compose
file competes with the quadlet units") and keeps a live check for a re-added
entry, so it still fails when one appears: verified by recreating a compose file
with a comfyui service and watching three tests go red, then removing it.

**AGENTS.md, which was wrong about ComfyUI.** It said ComfyUI runs CPU-only
("no ROCm wheels for gfx1151, CUDA images wrong"). That was true in the
compose era and is false now: the restored unit runs with /dev/kfd + /dev/dri and
must NOT pass --cpu. An agent trusting the rule file would have re-broken it.
Also corrected: the observability paragraph ("RUNNING BUT UNCONFIGURED, no
datasource, no rules" — all three have been configured since 2026-09-16), the
Active runbook row that still named halogen for frank-large, halogen's absence
from the Retired table, the benchmark policy naming halogen's harness, and the
seam list.

**Unit and page claims.** prometheus.container said "no alerting rules anywhere
in this stack"; node-exporter.container said Dankserver runs from its compose
stack; Prometheus.md documented three jobs as working (they scrape HTML: they
can never report up) and said no dashboard existed; index.md and the three
authentik service pages pointed at the retired file; Authentik.md's upgrade
instruction told you to bump an image tag in it.

One bad edit of my own on the way (a stale line number clobbered a See Also
entry in Prometheus.md) — caught by reading back, fixed, and the vault link
checker now proves the cross-references hold.

dankclaw/observability/quadlet/node-exporter.container

@@ -19,7 +19,9 @@
 # the wildcard bind off the table matters: this is the second half of the
 # pairing that removes the unauthenticated observability surface, and both
 # consumers are accounted for. Dankserver runs its own copy of this container
-# (scraped by the "node-dankserver" job) from its own compose stack.
+# (scraped by the "node-dankserver" job) — since 2026-09-16 as a Quadlet unit in
+# the same shape (dankserver/observability/quadlet/), because the compose-only
+# version it replaced had been dead for a day and a half before anyone noticed.
 #
 # MOUNTS. The container reads the host's /proc, /sys and / as /host/* read-only
 # and is pointed at them with --path.*; it writes nothing anywhere.

dankclaw/observability/quadlet/prometheus.container

@@ -25,8 +25,15 @@
 # namespace and dank owns /opt/prometheus/data. The image's default user
 # (nobody) maps to a subuid that cannot write it.
 #
-# There are no alerting rules and no Alertmanager anywhere in this stack: the
-# scrape config is the whole of its configuration.
+# RULES. Five LLM alert rules and one recording rule load from
+# /etc/prometheus/rules/ (installed from shared/prometheus/rules/ by the
+# deployer). There is still **no Alertmanager**, so nothing is delivered: a
+# firing alert is visible in Prometheus and on the Grafana dashboard's ALERTS
+# panel and reaches nobody. Delivery is an operator decision, not an oversight;
+# the fragility is that an undelivered alert looks identical to a quiet one.
+#
+# The config volume is also why rules belong in git: editing them in the UI is
+# lost on the next deploy, since the deployer overwrites the whole directory.
 
 [Unit]
 Description=Prometheus metrics store (Dankclaw)