site: restore the remote SSH copy — HELD, do not merge (FRE-997, remote half)

DO NOT MERGE OR DEPLOY THIS BRANCH. It is the held half of FRE-997, split out
of a336a6c at the Code Review Engineer's changes-requested verdict and the
Chief of Staff's 2026-11-03 launch hold (comment 2ccad154), and it is stacked
on `freno-dev/FRE-997-count-18` so its own diff stays remote-only.

The copy it restores was pulled by FRE-323 (c1c498e, c718370). FRE-997's
argument is that those removals were checked against claims the copy never
made: hosts come from `~/.ssh/config` and Tailscale (`RemoteHostDiscovery`),
the one-time `ssh-copy-id` is a prerequisite the row hands the user as a
command (`RemoteHostStatus.fixCommand`), the per-host credential is minted and
copied over (`RemoteMirror`), and a remote host mirrors this Mac's integrations
(`RemoteMirrorReconcile`). Two things in the old copy were genuinely wrong and
are fixed rather than restored: the "every hooked agent" overstatement (Muse,
Cline and Amp are `.unsupported` for remote and are named) and the count.

It may land only when all of these are recorded on FRE-997:

1. a CTO verdict that the one-click flow was run on the shipping build;
2. footage of a remote agent joining the island;
3. the Chief of Staff revising the FRE-346 §3 launch gate and taking the
   public-claim call to the sponsor.

Until then the live site keeps the FRE-323 state. The restore condition this
commit deletes (`marketing/drafts/remote-ssh/copy.md`) is the gate being cited:
FRE-205 is todo/unassigned, FRE-320 is a verdict task, and no recording exists.

- The Remote collage tile and its mock.
- The "Any SSH box, one click away" breakdown with its RemoteHostDemo.
- The "One-click SSH setup" chip.
- The /agents remote paragraph and the Cline/Amp "this Mac only" rows.
- The approvals bullet names the three local-only agents instead of claiming
  every hooked agent.
- remote-claims.test.ts guards the restored copy plus the two overstatements
  that must not return.
- positioning.md moves remote SSH to publishable with its backing.

Gate on this branch, this run: `bun test src/routes/nook` 17 pass / 0 fail;
`bun run build` succeeds. Green tests do not lift the hold.

src/routes/nook/agents.tsx

@@ -209,7 +209,8 @@ const AGENTS: AgentEntry[] = [
   },
   {
     name: "Cline",
-    wiring: "One hook file per event in its hooks directory",
+    wiring:
+      "One hook file per event in its hooks directory. This Mac only — remote hosts skip it",
     events: [
       "SessionStart",
       "SessionEnd",
@@ -334,7 +335,8 @@ const AGENTS: AgentEntry[] = [
   },
   {
     name: "Amp",
-    wiring: "In-process extension package",
+    wiring:
+      "In-process extension package. This Mac only — remote hosts skip it",
     events: [
       "SessionStart",
       "SessionEnd",
@@ -387,7 +389,9 @@ export default function NookAgentsPage() {
           Each agent reports its own set of events. "Allow / Deny from a card"
           means the agent hands the decision to The Nook while it waits;
           "Observe" means every event still appears live, but the agent keeps
-          its own prompting.
+          its own prompting. Agents can run on this Mac or on remote machines
+          over SSH — remote sessions report into the same grid. Muse, Cline and
+          Amp run on this Mac only.
         </p>
 
         <div class="grid gap-4 lg:grid-cols-2">