Split the simulation spine into leaves (P4)

What changed

SKILL.md carried the lifecycle inline and gce/gce.md (about 18,300 words) loaded whole on every task. The spine is now 8 binding rules plus one routing block per task (fires, done when, pointer), 1,283 words. gce/gce.md is deleted and its text moves, unedited, into task leaves. Loaded words across the skill fall from 48,669 to 46,576. A single omnibus search probe loads about 4,100 words where it loaded 26,600.

Leaf text is moved, not trimmed. Several leaves exceed the budgets in the merge design; trimming is P5's.

DIAGRAM: none. This is a file reorganisation with no change of path, flow or mechanism.

Split map

Old section	New home
Choosing a base, boot image, version and nightly pins, k3s pin, CNG build, roadmap, pedigree, stay current, validation matrix	gce/bases.md
Teardown, default full teardown, state, prerequisites, driving, cleanup, troubleshooting, bootstrap troubleshooting, security model, cost	gce/operations.md
Dev base	gce/dev-base.md
Backing-service access, backing services not provided	gce/backing-services.md
Patched code (caproni, omnibus)	gce/patched-code.md
Reading a caproni run, policy and registry	gce/reading-runs.md
Advanced Search, exact code search, search probes	gce/search.md
HTTPS behind a private CA	gce/https-private-ca.md
DAP block	gce/dap.md
Geo block	gce/geo.md (verbatim)
Real-model block	gce/aigw.md § Real model (verbatim)
Orbit	orbit.md
Canonical-primitive discipline, implementation notes, caproni bootstrap internals, design decisions	MAINTENANCE.md

airgap.md, openshift-local.md, openshift-sno.md and mcp.md gain a pointer line only. README, the AGENTS.md map, the contribution skill's environment.md and the help text and comments in justfile, simulation.sh, drift-check.sh, bootstrap-gitlab.sh, zoekt-omnibus.sh and advanced-search-omnibus.sh now name the new leaf. The description frontmatter is unchanged.

Rulings applied

1. Rule 2: where lab spend is approved, provision without asking per VM; otherwise get explicit approval. Every up raises a notification through a notifier when one is on PATH. Making cmd_up notify itself is a separate later change.
2. Rule 7 and aigw.md state one generic sentence: match the lab's model family to what the target organization permits. No organization or vendor is named.
3. Dev base: the VM stays up until the merge request's pipeline is green, so a CI failure is fixed on the same rig. Then down --instance <name>, never a raw gcloud delete. Rule 3 carries this one exception.
4. The spine is over the design's 900-word target. P5 resolves that.

Vendor patches

Both patches (gitlab-psql, gitlab-clickhouse) now name gce/backing-services.md, heading unchanged. just vendor-sync c5272c9 at the unchanged pin, with skillspector v2.2.3, reproduces the committed tree: the diff touches only the two patch files and the two patched SKILL.md files (6 lines each), the manifest is byte-identical, and the scan reports 28 matched, 0 unmatched.

Simulation verdicts

Two arms per case: origin/main skill tree (A) against this tree (B), claude-sonnet-5-5 at high effort, plan mode, project settings only, sims/, CONTRIBUTING, AGENTS, MAINTENANCE and CHANGELOG fenced out. Nothing provisioned or posted.

Case	Catches checked	A	B	Verdict
1 Seeding (stored task)	Ultimate plus runner, zero is honest; call-time stamping and rolling window	both	both	KEEP
2 Real model, Vertex (stored task)	billed, real-model off ends it and down does not; Model Garden card is a human step; direct mode for the finding, proxy to attribute; @-suffixed model id	all	all	KEEP
3 Geo registry mid-migration	geo license with staging mode, never License.new; verify refuses unlicensed; SIM_GEO_PAIR and geo list first; legacy mode then registry-migrate primary; geo down	all	all	KEEP
4 Teardown, omnibus (new, run twice)	instance and owner on every command, no bare down; down after arms 1 and 3, fresh up for arm 2; --max-runtime past 90 min; completion watch with copy and down; no instances stop	all	all, plus the stdout-only leftover count and the notification on up	KEEP
5 Teardown, dev (new)	A: down at once. B: full set validated, push, hold until green, then down naming the instance, no raw gcloud	per ruling 3	per ruling 3	KEEP (ruled change)
6 State file (new)	brief line verbatim; status or jq projection; token by substitution; SIM_INSTANCE=sim-dap-1	all	all	KEEP

Seeding's third catch in the stored case (admin token on the VM at the path the seeding leaf names) appeared in neither arm.

Checks

just ci is green at the branch head: frontmatter, prose, vale, sims-check, yaml, vendor-tree, check, lint, test, and the sign-off and disclosure check on the commit.