refactor: retire scripts/ in favor of lib/ and tools/

[chutch3]

Retires the top-level scripts/ junk-drawer, sorting its contents by role instead of leaving them in a catch-all.

What moved

• scripts/common/ssh.sh → lib/ssh.sh — the one genuinely-shared bash helper (sourced by kiwix + status-pipeline). New top-level lib/ for shared sourced code.
• scripts/common/{cert.sh, nas/omv.sh, nas/install-cert-remote.sh} → stacks/apps/cert-sync-nas/common/ — these were used by only cert-sync-nas (and bind-mounted into its container), so the app now owns its full runtime bundle. cert-sync-nas/common/ssh.sh is a vendored copy (omv.sh sources it as a co-located sibling, in-container and in tests) — this deliberately decouples the deployed container from the shared dev helper.
• scripts/status-pipeline/ → tools/status-pipeline/, scripts/cluster-health.sh → tools/cluster-health.sh, scripts/dev/ → tools/dev/ — invocable tooling, sibling to tools/ci.
• Bats tests follow their subjects: ssh_test → tests/unit/lib/, cert_test/omv_test → cert-sync-nas/tests/.

scripts/ no longer exists.

Why

scripts/common was a junk drawer: 3 of its 4 files were single-owner (cert-sync-nas), not shared. Grouping by what something is (shared lib / app-owned bundle / invocable tool) removes the distance-coupling where an app reached ../../../scripts/common to mount its own code.

Notable

• cert-sync-nas swarm configs:: only the file: source paths changed (../../../scripts/common/... → ./common/...). In-container target: paths and COMMON_DIR=/scripts/common are byte-identical, and file contents are unchanged — so no config-version bump needed.
• .gitignore: added anchored negations (!/lib/, !/tests/unit/lib/) because the boilerplate Python venv-ignore (lib/) would otherwise swallow our committed source.
• Updated all references: Taskfile (includes, bats globs, kcov pattern, dev path, lint:shell), ansible Taskfile, pre-commit, .env.example, llms.txt, docs.

Verification

• Full bats suite: 129 passing (moved tests/unit/lib/ + stacks/apps/*/tests/)
• task --list resolves the status-pipeline:* namespace from its new home
• docker compose config for cert-sync-nas is valid; all four bundle files resolve

🤖 Generated with Claude Code