Remove legacy language and enforce greenfield policy

Author: joshp123

AGENTS.md

@@ -53,4 +53,4 @@ Deploy flow (automation-first):
 Key principle: mental notes don’t survive restarts — write it to a file.
 
 Cattle vs pets: hosts are disposable. Prefer re-provisioning from OpenTofu + NixOS configs over in-place manual fixes.
-One way only: AWS AMI pipeline via S3 + VM Import. No Hetzner, no rescue-mode hacks, no legacy paths.
+One way only: AWS AMI pipeline via S3 + VM Import. This is a greenfield repo. Do not reference "existing", "legacy", or alternate paths anywhere in code or docs.

infra/opentofu/aws/README.md

@@ -1,6 +1,6 @@
 # OpenTofu (AWS S3 Image Bucket)
 
-Goal: reuse the existing S3 bucket for CLAWDINATOR images, plus create the VM Import role and attach import permissions to the existing CI IAM user.
+Goal: use the CLAWDINATOR S3 bucket for images, plus create the VM Import role and attach import permissions to the CI IAM user.
 
 Prereqs:
 - AWS credentials with permissions to manage IAM (use your homelab-admin key locally).
@@ -13,12 +13,12 @@ Usage:
 - tofu apply
 
 Outputs:
-- `bucket_name` (existing)
+- `bucket_name`
 - `aws_region`
-- `ci_user_name` (existing IAM user)
+- `ci_user_name`
 
 CI wiring:
-- Keep existing GitHub Actions secrets:
+- Set GitHub Actions secrets:
   - `AWS_ACCESS_KEY_ID`
   - `AWS_SECRET_ACCESS_KEY`
   - `AWS_REGION`

infra/opentofu/aws/outputs.tf

@@ -8,5 +8,5 @@ output "aws_region" {
 
 output "ci_user_name" {
   value       = data.aws_iam_user.ci_user.user_name
-  description = "Existing IAM user expected to be wired in CI."
+  description = "IAM user expected to be wired in CI."
 }

infra/opentofu/aws/variables.tf

@@ -4,13 +4,13 @@ variable "aws_region" {
 }
 
 variable "bucket_name" {
-  description = "Existing S3 bucket name for image uploads."
+  description = "S3 bucket name for image uploads."
   type        = string
   default     = "clawdinator-images-eu1-20260107165216"
 }
 
 variable "ci_user_name" {
-  description = "Existing IAM user used by CI (keys already wired in GitHub)."
+  description = "IAM user used by CI."
   type        = string
   default     = "clawdinator-image-uploader"
 }