Add Axiom datasets and Firewalla on-box config to the enforced-surfaces table

[cpitzi]

Closes #62

Summary

Extends Live-state vs. code discipline → Known enforced surfaces with two surfaces whose live state is applied from git:

• Axiom datasets + retention (cjp-solidago-*): lentago/betula's terraform workflow applies terraform/ on every merge to main. It went live 2026-10-06 (betula#118, first apply 2 imported, 0 changed). Datasets carry prevent_destroy; tokens are not yet managed (betula#119). A console edit to retention would be reverted by the next betula merge, which is exactly the case the table exists to warn about.
• Firewalla on-box config (Fluent Bit conf, user_crontab, collector scripts including the device_inventory collector): betula's on-device gitops-sync.sh pulls main every 5 minutes. This surface predates the table and was never listed. The 2026-10-05 device-inventory outages (drosera#151) came from a hand-installed cron line being dropped by exactly this mechanism.

The ~/repos/CLAUDE.md local mirror was updated identically; the table section was diffed between the two copies. claude-review.yml's review prompt doesn't carry this table, so no third mirror needed changing.

🤖 Generated with Claude Code

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lentago/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b845709b-1495-4f12-83b8-3367e127a3ae

📥 Commits

Reviewing files that changed from the base of the PR and between aefeef3 and c98d1f9.

📒 Files selected for processing (1)

• CLAUDE.md

 ___________________________________________________________________________________________________________________________________________________________________________
< You talkin' to me? You talkin' to me? Then who the hell else are you talking...you talking to me? Well, I'm the only one here. Who do the bugs think they're hiding from? >
 ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}