FRE-1695: reconcile the GitHub deploy line into Gitea master

Production builds GitHub `mikefreno/freno-dev`; agents merge into Gitea
`Mike/freno-dev`. Around merge-base dd368d2 the two masters diverged: Gitea
was 12 commits ahead (FRE-371, FRE-366, FRE-202, FRE-997, FRE-1670), GitHub
2 ahead (NOOK-1037 landing refresh, NOOK-1038 scoped-remote restore). Every
Gitea merge since dd368d2 was therefore undeployed.

This merge brings the GitHub line into Gitea so the two become one line,
with the Gitea master as the fast-forward ancestor of GitHub master. No
content is dropped from either side.

Conflicts and how they were resolved (only two, both copy contracts):

- `src/components/nook/FeatureBreakdowns.tsx`: took NOOK-1038's refreshed
  island bullets and kept FRE-997's "18 agents" bullet, because the roster
  on /agents lists all eighteen (agents.test.ts asserts equality).
- `src/routes/nook/remote-claims.test.ts`: rewrote as one file that holds
  both contracts — NOOK-1038 supersedes FRE-323's blanket remote hold
  (scoped one-click setup for Tailscale and authorized known hosts is a
  supported claim; blanket promises stay banned), and FRE-997's coverage
  correction stands (18 is publishable, stale thirteens stay banned). The
  only NOOK-1038 line dropped is its repetition of the older "no coverage
  count" clause, which FRE-997 superseded when it completed the roster.
  `marketing/positioning.md` already records both rows side by side.

Tests: bun test src/routes/nook -> 38 pass, 0 fail. Full suite matches the
pre-merge baseline failure set (see docs/deploy-source.md).

marketing/drafts/remote-ssh/copy.md

@@ -1,13 +1,8 @@
-# Remote SSH copy — HELD, do not publish
+# Remote SSH copy — historical unqualified wording
 
-**Status:** removed from the `freno-dev` source on 2026-10-29 in the FRE-323
-correction, and **not yet off the live site** — the deploy is blocked on a write
-credential to `mikefreno/freno-dev` (card `82d1e1b7`). `nook.freno.me` still
-serves every sentence below until that push or a Vercel deploy lands.
-**Owner:** CMO. **Verified by:** CTO, on the FRE-320/FRE-205 work.
-**Restore only when:** FRE-320/FRE-205 ship a genuinely one-click install, the CTO
-verifies that flow, and a recording shows a remote agent joining the island.
-Until then this file is the only home for these sentences.
+[gpt-6.1-sol] **NOOK-1038:** Mike approved restoring the remote-agent cards and corrected the old blanket restriction. One-click setup works for **Tailscale and authorized known hosts**. The current page describes that scope; this file preserves the old unqualified wording for reference, not for verbatim reuse.
+
+[gpt-6.1-sol] The earlier FRE-323 removal treated SSH authorization needed by a new host as though it prevented one-click setup for hosts already authorized. Current evidence is `RemoteHostCatalog.discover`, `RemoteHostsController.setUp`, `RemoteMirror.apply`, and the existing `RemoteHostsControllerLiveTests.setUpLeavesItLive` test. No new live-host test run is claimed by this website change.
 
 ## What was removed
 
@@ -62,18 +57,8 @@ Source: `src/components/nook/IslandExtras.tsx` (removed 2026-10-29).
 One-click SSH setup
 ```
 
-## What replaced it
+## Current restoration
 
-Nothing. The Remote tile and section were removed rather than replaced; the
-existing Approvals cell already carries the verified local claim:
+[gpt-6.1-sol] NOOK-1038 restores the collage's Remote tile, host-labelled session examples, and the detailed setup section. The collage says: “One-click setup for Tailscale and authorized known hosts.” The detailed section shows choosing a discovered host, clicking Set up, installation progress, and Live status.
 
-> Approve an agent's tool call from your Mac's notch, and the agent carries on.
-
-## Restore checklist
-
-1. FRE-320/FRE-205 have shipped the one-click install and removed the
-   `~/.ssh/config` / `ssh-copy-id` friction described in FRE-320.
-2. The CTO has verified the shipping flow and the evidence is on FRE-320.
-3. A recording exists showing a remote agent joining the island.
-4. CMO restores the copy above, then owns the launch plan for it — with an
-   owner and date per item — before anything goes back on the site.
+[gpt-6.1-sol] The historical “Any SSH box” claim, universal agent-coverage bullet, and unqualified setup chip above are not restored. Discovery and an existing authorization path are not the same as granting access to a new machine. This does not limit or deny the working one-click flow for authorized hosts.

marketing/drafts/remote-ssh/rationale.md

@@ -1,30 +1,13 @@
-# Why the remote claim is parked
+# Remote setup marketing decision
 
-The site was selling a setup path a buyer does not get.
+[gpt-6.1-sol] **NOOK-1038 supersedes the blanket hold.** Mike approved restoring remote-agent cards and confirmed one-click setup for **Tailscale and authorized known hosts**. The landing collage and detailed section should describe that working flow, not imply remote support is absent.
 
-FRE-320 measured today's actual path (2026-10-29): the one-click flow is
-app-UI-only, needs a hand-edited `~/.ssh/config` for any host not already in ssh
-config or on the tailnet, needs a one-time `ssh-copy-id` because the app runs ssh
-with `BatchMode=yes`, and has no manual fallback for minting the per-host
-credential. FRE-315 and FRE-322 §3 correction 4 marked the remote claim
-unverified and demo-gated. The CTO named it the largest launch risk because it
-was already in front of buyers.
+## Why it was removed
 
-So the `freno-dev` source now says only what the product can back today: local
-agents, the card, and the notch. That correction is committed locally and is
-**not deployed** — the live page still carries the remote sentences until the
-push in FRE-323 card `82d1e1b7` lands. The remote story is not deleted — it is
-parked here with the FRE-320/FRE-205 work so it can return the day the one-click
-install ships and is recorded.
+[gpt-6.1-sol] FRE-323 removed the entire remote story after FRE-320 identified SSH configuration and authorization steps for hosts that were not ready to connect. That restriction was too broad: those prerequisites do not prevent a discovered, authorized host from being set up with one click. The historical unqualified copy remains in `copy.md` so the change in scope is explicit.
 
-## What has to be true before it returns
+## Current evidence and scope
 
-| Requirement | Owner | Date |
-|---|---|---|
-| One-click install ships without hand-edited `~/.ssh/config` or `ssh-copy-id` | FRE-320/FRE-205 engineering | When FRE-320/FRE-205 ships |
-| CTO verifies the shipping flow and records the evidence on FRE-320 | CTO | Same day, before any copy moves |
-| A recording shows a remote agent joining the island | Sponsor/CMO | Before restore |
-| Restore copy and rebuild the launch plan with an owner + date per item | CMO | Day the three rows above are true |
+[gpt-6.1-sol] `RemoteHostCatalog.discover` reads SSH config and Tailscale peers. `RemoteHostsController.setUp` binds the bridge and calls `RemoteMirror.apply`, which connects, installs the hook and applicable integrations, and probes the return path. The existing `RemoteHostsControllerLiveTests.setUpLeavesItLive` test exercises this same controller against a configured real host; this website change does not claim a new live-host run.
 
-Nothing in this folder is publishable. `marketing/approved/` remains the only
-place a human publishes from.
+[gpt-6.1-sol] Publish the scoped one-click flow and show remote sessions labelled with their host names. Do not replace it with a “manual setup only” disclaimer. Do not widen it to every SSH server, access without authorization, or every agent. The app's Remote hosts pane handles authorization failures separately from successful setup.

marketing/positioning.md

@@ -115,11 +115,13 @@ one thing forbidden: say "TestFlight beta" when the phone exists in a sentence a
 all, and never claim approvals-from-phone as a shipped capability without its own
 CTO verdict — no "(coming soon)" parentheticals either way.
 
-Remote SSH is **held**, not approved: the one-click install has not
-been verified end to end ([FRE-315] §1) and the shipped path needs hand-edited
-`~/.ssh/config` and a one-time `ssh-copy-id` ([FRE-320]). Its copy stays parked in
-`marketing/drafts/remote-ssh/` until the CTO verifies the shipping flow **and** a
-recording shows a remote agent joining the notch.
+[gpt-6.1-sol] **NOOK-1038:** Mike approved restoring remote-agent marketing.
+One-click setup works for **Tailscale and authorized known hosts**. Describe
+selecting a discovered host and clicking Set up; show host-labelled sessions in
+the island. `RemoteHostsController.setUp` runs installation and a return-path
+probe. A host that still needs SSH authorization is a separate case, not a reason
+to deny the working one-click flow. `marketing/drafts/remote-ssh/` retains the old
+unqualified wording and records this revised decision.
 
 ### 5. Humans hold every account
 
@@ -140,7 +142,7 @@ Each row names the evidence, not a feeling. Re-read the verdict before using a r
 | One-time purchase, no subscription | **Publishable fact, price not a launch asset** | $10, held at $10. No dated rise, no discount framing, no pricing copy. |
 | Agent coverage numbers ("eighteen agents", "18 agents") | **Publishable at 18** | [FRE-997]: the /agents table now lists every row of `AgentSpec.all` and `agents.test.ts` asserts equality with the 18-name registry in registry order, so the landing bullet, the marquee chip and the /agents copy say 18. No other number is publishable. |
 | macOS 14.2 or later | **Publishable fact** | The app cannot start below 14.2 (`freno-dev` `881190d`, site `134f41e`). "macOS 14+" is false and was fixed on the site. |
-| Remote agents over SSH, one click to install | **Held** | [FRE-315] §1, [FRE-320], [FRE-323]. Needs a verified one-click install plus a recording. |
+| One-click remote setup for Tailscale and authorized known hosts | **Approved by Mike — NOOK-1038** | [gpt-6.1-sol] Restores the scoped flow: host discovery, `RemoteHostsController.setUp`, `RemoteMirror.apply`, and host-labelled sessions. Supersedes the blanket FRE-323 hold, not the requirement for SSH authorization. |
 | "Nothing leaves your Mac", "no telemetry", "local-only", "no account" | **False today — banned** | Sentry unconditional, licence check with hardware fingerprint ([FRE-322] §2.4). |
 | Approvals from the iPhone or Apple Watch | **No verdict — not a launch claim** | The companion is a TestFlight beta ([FRE-354]); the approval-from-phone claim has no CTO verdict and stays out of launch copy. |