ci: platform.hanzo.ai is the sole orchestrator — drop dead GHA cicd.yml (#16)

bootnode org has 0 self-hosted runners, so the reusable hanzoai/ci
workflow (runs-on the org-scoped arc pool) queued forever and never
built anything. Remove .github/workflows/cicd.yml and let platform.hanzo.ai
own build+test off this repo's hanzo.yml: its GitHub App delivers push/PR
to the platform webhook, which builds each image on the shared in-cluster
hanzo-build-* arcbuild pool and pushes ghcr.io/bootnode/bootnode:<sha>-amd64-<suffix>.

Rollout stays GitOps (luxfi/universe), not platform — the Deployment-style
deploy.services form is build-only to the platform. One canonical path.

.github/workflows/cicd.yml

@@ -1,16 +0,0 @@
-# Build + test + deploy — all logic lives in hanzoai/ci; config is in hanzo.yml.
-# Runs on our cloud arc pool by default; for your own runners add
-# `with: { runner: '["self-hosted","your-pool"]' }`.
-name: CI/CD
-
-on:
-  push:
-    branches: [main]
-    tags: ["v*"]
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  cicd:
-    uses: hanzoai/ci/.github/workflows/build.yml@v1
-    secrets: inherit

hanzo.yml

@@ -1,10 +1,16 @@
-# Hanzo CI/CD — one declarative build + test + deploy config.
+# Hanzo CI/CD — one declarative build + test config.
 #
-# Read by .github/workflows/cicd.yml (which runs on our self-hosted arc runners,
-# not GitHub-hosted) and by platform.hanzo.ai. Replaces the old .platform.yml.
-# Registry + cluster credentials come from KMS at build time (the repo only sets
-# KMS_CLIENT_ID / KMS_CLIENT_SECRET + KMS_WORKSPACE), so no long-lived secrets
-# live in GitHub.
+# Read by platform.hanzo.ai, the sole orchestrator for this repo. On every
+# push / PR the platform GitHub App delivers the event to platform, which reads
+# THIS file and builds each image on the shared in-cluster `hanzo-build-*`
+# arcbuild pool (bootnode has no self-hosted runners of its own — the reason the
+# old GitHub-Actions `.github/workflows/cicd.yml` dead-ended and was removed).
+# Registry credentials live in the cluster (kaniko-ghcr), never in GitHub.
+#
+# Images publish to ghcr.io/bootnode/bootnode as `<sha>-amd64-<tag-suffix>`.
+# Rollout is GitOps, not platform: luxfi/universe pins the freshly-built tag and
+# Argo applies it. The `deploy:` block below is therefore advisory (platform
+# treats the Deployment-style `services:` form as build-only).
 
 images:
   - name: api