chore: take vote-service out of the repository root

Removes the Go source, Dockerfile, go.mod, and Kubernetes manifests. The
deployed service is untouched and the review desk still calls it over
window.SKILLS_REVIEW_VOTE_API; only the source leaves.

The runbook does not leave. vote-service/README.md moves to
docs/vote-service.md, because it carries the parts that are hard to
rediscover: why the ingress overwrites X-Forwarded-For and Caddy stamps
X-Client-IP instead, why the image is side-loaded into containerd rather
than pulled, and why the PVC pins the Deployment to one node.

This drops verify.mjs from 84 assertions to 83. The removed one read
vote-service/main.go for X-Forwarded-For and 'one active vote per skill'
-- the review desk's only anti-abuse control -- and there is no file left
to read. It is the first assertion this repository has ever lost.

Rather than lower the gate's floor and leave a bare number behind,
gate.sh now subtracts the number of entries in
.agents/context/assertion-removals.md from the baseline. A removal costs
a written reason in a tracked file, in the same commit, as a visible
diff. Tested at 82 assertions: still refused.

Also drops the 22 MB of PNG baselines under .agents/snapshots/before/ and
before-reduced-motion/. They pictured the hand-written site, which no
longer exists; visual-regression.mjs has no compare mode to diff them
against; and they are recoverable from d88d8b8.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/operations-guide.md

@@ -27,7 +27,7 @@ worktree practices taught by the presentation fit together.
 | Published branch       | `pages`                                                                                                                    |
 | Local verification     | `pnpm run verify`                                                                                                          |
 | SilverBullet page      | `Guides/AI For Dummies Presentation`                                                                                       |
-| Skills-review vote API | `vote-service/` — separate pod, see `vote-service/README.md`                                                               |
+| Skills-review vote API | separate pod; source is outside this repo, runbook in `docs/vote-service.md`                                               |
 
 ## How the site is built
 
@@ -174,14 +174,16 @@ certificate.
 ## Skills-review vote service
 
 `skills-review/` is served by the same static Pages Server as the rest of this
-site, so it cannot itself remember votes. `vote-service/` is a separate Go API
-on its own pod for that: one JSON file as the store, one vote per visitor
-enforced by IP (a MAC address never reaches a server across the internet). It is
-deployed independently of `main`/`pages` — the site can be republished without
-touching it, and vice versa.
+site, so it cannot itself remember votes. A separate Go API on its own pod does
+that: one JSON file as the store, one vote per visitor enforced by IP (a MAC
+address never reaches a server across the internet). It is deployed
+independently of `main`/`pages` — the site can be republished without touching
+it, and vice versa.
+
+The service's source is no longer in this repository; run these from wherever it
+now lives.
 
 ```bash
-cd vote-service
 docker build -t localhost:30892/ai-for-dummies-vote-service:latest .
 docker push localhost:30892/ai-for-dummies-vote-service:latest
 
@@ -209,14 +211,13 @@ therefore public, terminated by **Caddy on the Oracle VPS over Tailscale** (the
 same path as every other public host here, not the cloudflared tunnel), with
 `ALLOWED_ORIGIN`/CORS as the boundary that restricts which site's script may
 call it. After deploying, keep `window.SKILLS_REVIEW_VOTE_API` in
-`skills-review/index.html` in sync with `ALLOWED_ORIGIN` on the service.
+`src/pages/skills-review.astro` in sync with `ALLOWED_ORIGIN` on the service.
 
 One cluster-wide gotcha worth knowing before reading the vote code: the ingress
 controller runs with `use-forwarded-headers` off, so nginx _overwrites_
 `X-Forwarded-For`/`X-Real-IP` with the VPS's tailnet address. Caddy stamps the
 true client address into `X-Client-IP` instead. Full rationale, the Caddy block,
-and the anti-abuse design are in
-[vote-service/README.md](../vote-service/README.md).
+and the anti-abuse design are in [docs/vote-service.md](vote-service.md).
 
 ## Adding or changing a presentation section