Publish the console as hanzo-kms, since kms is a reserved slug

The first run on the GitHub plane gated and built the console, then the
publish stopped at "ensure project kms returned HTTP 400: slug is a
reserved subdomain and cannot be used". The admin console publishes as
hanzo-admin for the same reason; this one is hanzo-kms, and universe's
kms-static root follows it.

LLM.md

@@ -46,7 +46,9 @@ One caller, `.github/workflows/cicd.yml`, which uses
 client pair. It reads `hanzo.yml`: the gate (`go test ./...`, the console's tests and
 typecheck), the `kms` and `kms-fetch` images (built at the build door in-cluster;
 deploying one is a universe pin), and the console site (`frontend/dist`, Sites slug
-`kms`, main only, served at kms.hanzo.ai by universe `static-sites.yaml`).
+`hanzo-kms`, main only, served at kms.hanzo.ai by universe `static-sites.yaml`
+`kms-static` from `s3://hanzo-sites/hanzo/hanzo-kms`). Not `kms`: that is a reserved
+subdomain, and `/v1/projects` refuses it as a slug.
 
 GitHub is where it runs. The forge mirror of a hanzoai/* repo runs no workflows, so
 the caller that sat under `.hanzo/workflows` from 6ba3f6d83c (2026-09-15) built

hanzo.yml

@@ -20,9 +20,12 @@ images:
     repo: ghcr.io/hanzoai/kms-fetch
     version: 0.1.1
 
-# The console at kms.hanzo.ai: s3://hanzo-sites/hanzo/kms.
+# The console at kms.hanzo.ai: s3://hanzo-sites/hanzo/hanzo-kms, which universe
+# static-sites.yaml `kms-static` serves. `hanzo-kms`, as the admin console is
+# `hanzo-admin`: `kms` is a reserved subdomain, and /v1/projects refuses it as a
+# slug ("slug is a reserved subdomain and cannot be used").
 site:
-  slug: kms
+  slug: hanzo-kms
   dir: frontend/dist
   build: cd frontend && pnpm install --frozen-lockfile && pnpm build
   on: [main]