refactor!: remove host health-watch and scheduled dependency-drift workflow

[kyle-sexton]

No related issue: this PR closes nothing.

Summary

Owner direction 2026-09-14: delete stale and overengineered automation. This PR removes the host health-watch feature and the scheduled Dependency Drift workflow. It does not cut a release; nothing reaches a host until a later reviewed release is promoted.

Fix

Deleted:

• .github/workflows/dependency-drift.yml (daily schedule). scripts/Test-DependencyFreshness.ps1 stays and still runs as the freshness gate in release.yml.
• internal/healthwatch/ (alert, check, inventory, storage and their tests).
• internal/app/health_watch.go, health_watch_checker.go, health_watch_test.go, health_watch_install_test.go.
• internal/host/healthwatch_task.go, healthwatch_task_windows.go, healthwatch_task_other.go.
• internal/jobindex/snapshot_bytes_test.go, with SnapshotBytes, MaximumJobStateBytes and EncodedCatalogSize in file_store.go. Only health-watch called them.

Edited:

• internal/app/app.go: removed the host health-watch case, its two usage lines, and the Dependencies.ACL field that only health-watch read. bootstrap.go no longer passes it. ScheduledTaskCLI stays because host controller restart uses it.
• internal/config/config.go: removed the HealthWatchdog type, defaults and validation. Strict KnownFields(true) decoding is unchanged. A top-level healthWatchdog key is still accepted and ignored, and Load records a warning in Config.Warnings. The CLI prints it to stderr and the controller writes it to its log as config-warning.
• internal/config/config_test.go: TestLoadIgnoresLegacyHealthWatchdog loads a config with a populated healthWatchdog block and asserts it loads with one warning, and that the base config has none.
• internal/controller/reconciler_test.go, internal/app/doctor.go, internal/jobindex/file_store.go: removed the config fixture block and the comments that referred to health-watch.
• .github/actionlint.yaml: removed the ignore entry for the deleted workflow.
• README.md, docs/releases.md, docs/worker-image.md: freshness is now described as checked at release publication or by hand, not daily. The #freshness-policy anchor is kept.
• release/dependency-drift-review.json: removed the four sentences saying the daily dependency-drift job reconciles issue 283.
• .gitignore: comment wording only. The dependency-drift.json entry stays because it is the script's default output path.

Left untouched: docs/topics/repo-simplify-sweep/*, which are historical run records.

Host findings

Checked read-only on 2026-09-14. Both hosts load C:\Users\KyleSexton\AppData\Local\ci-runner\config.yaml, according to the ci-runner-fleet scheduled task arguments.

Host	healthWatchdog in config	ci-runner-health-watch task
melo-lap-001	not present	not present
melo-desk-001 (reached over SSH)	not present	not present

No host needs a change. The legacy-key handling covers any config this check could not see.

Verification

• go build ./..., go vet ./..., GOOS=linux go vet ./...: pass (go1.27.1).
• go test ./...: all packages pass.
• golangci-lint run ./... (v2.13.1 built with go1.27.1): 0 issues.
• actionlint -shellcheck= -pyflakes=: exit 0.
• markdownlint-cli2 README.md docs/releases.md docs/worker-image.md: 0 issues.
• pwsh -NoProfile -File scripts/Test-ReleasePins.ps1: "Release and workflow pins are internally consistent."
• node --test .github/scripts/*.test.cjs: 21 pass, 0 fail.
• Fresh-context verifier (opus, given the scope but not this session's reasoning): first pass at 24fac49 FAIL on one stale sentence, where docs/releases.md:64 still described "the daily official-release check". Every other check passed: build, vet, tests, lint, pin test, node tests, no leftover references, no dangling symbols, legacy config loads with a warning, unknown keys still rejected, release freshness step intact. Fixed in a7ce55b. Re-verify at a7ce55b: PASS. No daily or scheduled freshness wording remains, and the only healthWatchdog hits are the legacy-key acceptance and its test.

Related

Refs: melodic-software/github-iac#378
Refs: #357
Refs: #227

BREAKING CHANGE: ci-runner host health-watch check and ci-runner host health-watch install-task are removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_019mo9xaZ53JHHy4aBjgd8wK

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T19:34:08.669428Z	a7ce55b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.