chore: remove dead code and update outdated defaults #95

Context

Audit on 2026-11-09 (grep over all non-test references; ripwire reported 0 dead code, a floor). Each item verified by the auditing agent; re-check each before deleting.

Dead code:

• fleet.SSHRunner.RunRemote (internal/fleet/ssh.go:35), tenant.Manager.RemoveRoutes (internal/tenant/piper.go:149), ui.InputPassword (internal/ui/prompt.go:80), ui.AbsentMark/MarkStarred (markers.go:23,32), setDefaultLocale (locale.go:211, test-only), exporterGuardUnit const (monitoring_guard.go:21).
• Rocky fail2ban branch in security.go:120-122: unreachable because config/distro.go:110 rejects security.fail2ban on Rocky.
• PackageManager.AddKeyring/AddSourceList: APT-only, RPM versions are error stubs (exec/rpm.go:105,111).

Outdated:

• Generated files carry # Managed by rootfiles-v2 (20+ sites) and CreatedBy: "rootfiles-v2"; the project is rootfiles. Nothing parses the header, but changing it shows drift on every host once.
• docker-compose v1 compatibility symlink (docker.go:144-162); Compose v1 is end of life since 2023.
• dcgm-exporter:3.3.8-3.6.0-ubuntu22.04 (config/monitoring.go:21) is a 2024 image.
• CI TEST_INPUTS (.github/workflows/test.yaml:44) lists profiles/ and templates/, which no longer exist at the root.
• legacyUnattendedPaths cleanup (security.go:28-33) is three weeks old: keep, set a removal release.

Go toolchain and CI pinning are tracked in #87 and are not repeated here.

Implementation starts only on the owner's go-ahead.

Decisions

• Delete dead code in one PR; no "keep for later".
• AddKeyring/AddSourceList move to an APT-only interface used by the Ubuntu docker/nvidia paths.

• 2026-11-09: rename the generated-file header to # Managed by rootfiles (Action needed: one apply) and drop the docker-compose v1 symlink (Action needed: use docker compose). Basis: owner decision in the planning session.

• 2026-11-09: also update stale comments in internal/module/tenant.go: the tenantGuardScript comment names an internal host (replace with a generic description) and the module comment still says daily password sync (it runs every 2 minutes). Basis: spec work in PR docs(specs): per-feature design specs covering every source file #107.

• 2026-11-10: supersedes the 2026-11-09 header and compose lines. Owner requirement: updating the managed fleet must cause no disruption. (a) Header: treat # Managed by rootfiles-v2 and # Managed by rootfiles as equivalent when comparing managed files, so an existing file is never rewritten only for its header (a rewrite would reload sshd, restart fail2ban and journald, restart cloudflared and run systemctl daemon-reload, which can drop GPU access in runc containers). New or otherwise changed files get the new header. No Action needed line. (b) docker-compose: keep creating and keeping the v1 compatibility link; do not remove existing links. Acceptance: after updating a host that rootfiles check reported clean on the previous release, check stays clean. Basis: fleet rollout safety review 2026-11-10.

Changes

• Files listed above; internal/exec/package_manager.go, internal/exec/rpm.go; .github/workflows/test.yaml; release notes.

Acceptance criteria

• AC1: listed dead symbols are gone; go build ./... && go test ./... -race pass.
• AC2: grep -rn 'rootfiles-v2' internal is empty if the rename is approved; release note has the Action needed line.
• AC3: CI TEST_INPUTS names only existing paths.
• AC4: dcgm image bump verified by rootfiles doctor on one GPU host (recorded in the PR).

Tasks

• T1: dead-code sweep + RPM interface split (AC1)
• T2: CI path fix (AC3)
• T3: header rename, compose v1 decision (AC2)
• T4: dcgm bump (AC4)

Out of scope

• Go version bump and action pinning (ci: improvement plan from the 2026-11-07 CI survey (toolchain pinning and required checks) #87).