docs: re-audit remaining pages superseded by the AI-repo split, three-tier GitHub access, and classifier authorization

[JacobPEvans-personal]

Problem

Several pages still describe superseded models after recent architecture changes. The worst
offender is already fixed — autonomous-agents/github-access.mdx was rewritten to the
three-tier model in 2141d13 — so this issue tracks a re-audit of the remainder against
the current architecture, applying the same pattern.

Candidate stale pages (re-validate each against current main before editing)

A staleness pass flagged these; some may already be partially corrected, so verify current
content first (do not assume):

• AI workloads moved to a dedicated config-management repo (roles no longer live in the
  general apps repo): autonomous-agents/hermes-agent.mdx, ai-development/ai-orchestration-stack.mdx,
  local-llm/homelab-gpu.mdx, local-llm/mac-studio.mdx, observability/llm-observability.mdx,
  and infrastructure/repos/* (add the new AI repo hub).
• GitHub agent-access tier model superseded by the three-tier + per-repo write-lease model
  (the pattern already applied to github-access.mdx): autonomous-agents/secrets.mdx,
  security/overview.mdx, security/local-ai-isolation.mdx, security/tools/macos-keychain.mdx,
  conventions/git-transport.mdx.
• Agent authorization model — autonomous-agents/overview.mdx describes a fine-grained
  permission-count safety model that has been superseded by a classifier-based pre-authorization.
• Secrets-engine policy shape — security/tools/openbao.mdx describes a single broad policy
  that predates per-workspace, scope-bound roles.

Approach

Trunk-flow feature branch; one PR (or a few small ones). Match the neutral, capability-name
house style already used across the site. Verify with the repo build/link checker before PR.