feat(orchestrator): rename kvb-hub to Agent Orchestrator with the phase 2 surface

Surface (requirement 001 phase 2): navigation Stream (Inbox, Regeln) / Agents / Artifacts with keys 1-3 and hash routes (#graph and #tree redirect), header with title, command palette and settings only, server-side badges (unsnoozed inbox, beats within 900 s, open jobs), a Mayday banner with "aufheben", four stream chips with agent:/art:/seit: search, Filter and time menus, the inbox in main, an agents toolbar (Funk an alle with Newsletter, Broadcast, Pan-Pan, Security, Mayday; Priorität; Tag/Nacht), Post or Call in the agent panel, Ambiente in the settings and read-aloud over the seven classes with Mayday locked.

Rename (decision 9): hub/ is orchestrator/, the package kvb_orchestrator, the unit kvb-orchestrator-runner.service, scripts/orchestrator.sh, environment KVB_ORCHESTRATOR_*, make targets orchestrator-*, the MCP server, image and compose project kvb-orchestrator, the guard header X-Kvb-Orchestrator and the message marker [kvb-orchestrator msg <id>]. install runs migrate first: it stops the old container, removes its image and code, moves state, approvals and pinned keys, swaps the MCP registration, the PermissionRequest hook and the runner unit, and changes nothing on a second run (scratch-HOME test with stub docker, claude and systemctl). Saved views fall back to the old localStorage key once.

MEDUSA acceptances carried to the renamed paths: 82 rows whose lines are unchanged (reason prefixed "renamed from <old path>, line unchanged"), and 7 rows whose text changed only in the product name, the package name, a temp prefix or a new class argument, each upheld by one kvb-think-criticize skeptic (approval.py:60, messaging.py:53, server.py:56, tests/hub_support.py:64, passkey.py:205, page-agent.js:75, language.py:46).

Cost 101 %: the longer name adds 15 tokens of skill text; the operator approved it with the commit.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 101 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 87
🚦 Gate: ⚠️ cost 101 % > 100: ask the operator before the commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install project test update budget hub-install hub-check hub-pin hub-runner hub-hook watch-check
+.PHONY: install project test update budget orchestrator-install orchestrator-check orchestrator-pin orchestrator-runner orchestrator-hook watch-check
 
 # Install the skills globally into $HOME (.agents/skills + .claude/skills).
 install:
@@ -24,25 +24,25 @@ update:
 budget:
 	@python3 scripts/budget.py --repo . --top 5 $(if $(INDEX),--index)
 
-# Install, build and start only the kvb-hub, without touching the installed skills.
-hub-install:
-	@bash scripts/hub.sh install
+# Migrate, install, build and start only the Agent Orchestrator, without touching the installed skills.
+orchestrator-install:
+	@bash scripts/orchestrator.sh install
 
-# Check the installed kvb-hub: image, container, logs, HTTP, pinned keys, hook, runner, disk.
-hub-check:
-	@bash scripts/hub.sh check
+# Check the installed Agent Orchestrator: image, container, logs, HTTP, pinned keys, hook, runner, disk.
+orchestrator-check:
+	@bash scripts/orchestrator.sh check
 
-# Param: CREDENTIAL the blob the hub's "Passkey registrieren" shows: make hub-pin CREDENTIAL=<blob>
-hub-pin:
-	@bash scripts/hub.sh pin "$(CREDENTIAL)"
+# Param: CREDENTIAL the blob "Passkey registrieren" shows: make orchestrator-pin CREDENTIAL=<blob>
+orchestrator-pin:
+	@bash scripts/orchestrator.sh pin "$(CREDENTIAL)"
 
-# Install, enable and restart the kvb-hub runner user service.
-hub-runner:
-	@bash scripts/hub.sh runner
+# Install, enable and restart the Agent Orchestrator runner user service.
+orchestrator-runner:
+	@bash scripts/orchestrator.sh runner
 
-# Register the kvb-hub PermissionRequest hook in ~/.claude/settings.json.
-hub-hook:
-	@bash scripts/hub.sh hook
+# Register the Agent Orchestrator PermissionRequest hook in ~/.claude/settings.json.
+orchestrator-hook:
+	@bash scripts/orchestrator.sh hook
 
 # Show whether the agents-council watch hook is stuck.
 watch-check: