[CMGS]

Static whole-repo audit of main 5cdef6b: every source, test, script, image, workflow and doc file read in full, docs checked against the code. No logic bug found; this PR fixes doc and comment drift and lands a non-logic cleanup.

Docs and comments (6b54363)

• Push is no longer "the only ingestion path on the no-network lane" (sdk.md, sdk-python.md): git clone, push and pull run on every lane since 04f28ff.
• net_verb in silkd/git.rs no longer claims an egress guard; has_egress is private, its only caller being routes_directly.
• sandboxd-api.md Admission refusals lists the fenced-node refusal of replicating-pool claims that cluster.md already links to.
• deploy.md and scripts/sandboxd-e2e.sh describe the BRIDGE smoke step as it now is (an egress-lane claim, not a lane-detect check); stale "v0"/"v2" labels dropped.
• install-agent.sh names cocoon-agent cocoon's VM readiness signal (silkd is the claim's); android silkd.rc says the proxy variables reach execs wherever nothing routes directly; images.yml header drops its history narrative. These rebuild the base image and, through images.yml, every image.

Cleanup (ff1941c)

• errors.New for fixed error texts (sandboxd ca, sdk/go, mcp).
• tunnet TCP flag constants in one block in packet.go; config.ConfigField renamed config.Field (used only inside config).
• tunnet/pg.Confirm finds confirmed claims through a set, not a slice scan per claim (hourly, off the claim path).
• outbound.DropTunnels drops a d.proxy != nil check: ArmProxy sets the proxy before a door enters h.doors.
• sdk/go go.mod pin note and silkd Dockerfile header shortened; e2e/go.mod lists direct requires first with one replace block (go mod tidy leaves it unchanged); .gitignore groups its e2e and dist entries.
• Tests: a duplicate refill test removed, TestValidateSizes covers 2xlarge, testCAOnly is a helper, ASCII arrows in two messages.

Left as is

• Static config keeps accepting an invalid tenant name in a volume tenants list (it matches no tenant). Rejecting it at load would stop such configs from starting; kept for now.
• The tenants pg 200/s cold-lookup budget stays node-wide.
• The sbx-* cleanup loop shared by the hardware scripts stays copied.

Verification

Static round: compiled with go build/go vet on the touched Go packages, cargo fmt --check and cargo clippy -D warnings on silkd and boot/init, toolchain gofmt. No unit tests, gates or hardware runs locally; CI runs the suites.