[Epic] Reduce Symphony to its spec footprint: remove repo mode, unify the child boundary, move population to a hook

[moncher-dev]

Execution epic for the design published as "심포니 스펙 축소" (2026-09-04). The design's own conclusions are the input; this epic is the delivery sequence.

Standing constraints

• Dogfood. All code changes are made by dispatched workers through this board. The operator and the board steward do not edit source directly. The only exceptions are operator-side host actions, which are listed explicitly and marked as such.
• This orchestrator currently runs in repo-embedded mode, which the plan removes. The running daemon uses the installed CLI, not merged source, so merging the removal does not break it. The host must nonetheless be migrated to standalone project mode before the daemon is upgraded past the removal.
• One PR lands per steward cycle, furthest-behind branch first. Landing siblings together has reset three approvals already.

Phase 0 — host migration to project mode (operator action)

Prerequisite: #848 adds repository.slug to WORKFLOW.md, which standalone mode requires and repo mode ignores.

Then, at a moment when no run is active:

1. Create ~/symphony-projects/github-symphony/.
2. Symlink WORKFLOW.md there to the repository's copy, so the policy stays versioned in git and does not fork.
3. Create .env (0600) carrying GITHUB_GRAPHQL_TOKEN. Do not carry DOCKER_CONFIG; it is inert (ci(e2e): worker host lacks Docker Compose plugin #825).
4. gh-symphony repo stop, then gh-symphony project start --daemon --assigned-only --project-dir ~/symphony-projects/github-symphony.
5. Verify one dispatch end to end before proceeding.

Hook scripts need no move: hooks execute with the issue workspace as their working directory, so hooks/after_create.sh continues to resolve inside the checkout. Workspaces relocate under the project folder, which is expected and costs one repopulation.

Standalone mode already defaults to worktree-cache, so this also retires the hand-applied populate override recorded on #808.

Phase 1 — land what is already decided

#826 (publish action; PR #845 still missing the SIGTERM path), #825, #834, #812, and the #839 decision. #811 and its PR #828 are probably deletions rather than merges once repo mode goes, since the clone strategy exists to serve repo mode; confirm before spending another review round.

Phase 2 — remove repo-embedded mode

Three children, sized to one worker run each, landed in order. This is the pivot: every later phase then touches one code path instead of two.

Phase 3 — boundaries

One child-environment function replacing five allowlists and three denylists (#844, reshaped). MCP injection restored and gated by source rather than deleted. Hooks returned to the spec's shell contract.

Phase 4 — responsibility

Repository population moves to a hook with a shipped default script. Then the deletions: credential brokers, quarantine and attribution, the instance registry, orchestrator-authored tracker comments, and a trimmed doctor.

Phase 5 — documentation

Architecture map gains a spec-mandate column. The configuration reference replaces four disagreeing sections with one child-boundary section.

Sequencing rule

Phase 2 lands before Phase 3 and 4. Phase 3's child-environment work must land after #812, which edits both runtimes' forwarded context.