chore: take vote-service out of the repository root

Removes the Go source, Dockerfile, go.mod, and Kubernetes manifests. The
deployed service is untouched and the review desk still calls it over
window.SKILLS_REVIEW_VOTE_API; only the source leaves.

The runbook does not leave. vote-service/README.md moves to
docs/vote-service.md, because it carries the parts that are hard to
rediscover: why the ingress overwrites X-Forwarded-For and Caddy stamps
X-Client-IP instead, why the image is side-loaded into containerd rather
than pulled, and why the PVC pins the Deployment to one node.

This drops verify.mjs from 84 assertions to 83. The removed one read
vote-service/main.go for X-Forwarded-For and 'one active vote per skill'
-- the review desk's only anti-abuse control -- and there is no file left
to read. It is the first assertion this repository has ever lost.

Rather than lower the gate's floor and leave a bare number behind,
gate.sh now subtracts the number of entries in
.agents/context/assertion-removals.md from the baseline. A removal costs
a written reason in a tracked file, in the same commit, as a visible
diff. Tested at 82 assertions: still refused.

Also drops the 22 MB of PNG baselines under .agents/snapshots/before/ and
before-reduced-motion/. They pictured the hand-written site, which no
longer exists; visual-regression.mjs has no compare mode to diff them
against; and they are recoverable from d88d8b8.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

vote-service/deploy/ingress.yaml

@@ -1,31 +0,0 @@
-# Public exposure is required: the vote widget runs in each visitor's
-# browser (client-side JS on a static Pages site), so it calls this API
-# straight from the internet — it cannot reach a cluster-internal-only
-# Service. CORS (ALLOWED_ORIGIN in deployment.yaml) is the real boundary:
-# it restricts which origin's browser code may call the API, not which
-# network can reach it.
-#
-# No `tls:` block here on purpose: TLS is terminated upstream by Caddy on the
-# Oracle VPS, which reverse-proxies over Tailscale to this node's port 80
-# (the nginx ingress runs on hostNetwork and routes by Host). That is how all
-# ~21 public hosts in this account are served. Reaching this host publicly
-# needs the DNS record plus the Caddy block — see vote-service/README.md:
-#   cf-dns add ai-for-dummies-vote A 129.148.56.8
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ai-for-dummies-vote
-  namespace: ai-for-dummies
-spec:
-  ingressClassName: public
-  rules:
-    - host: ai-for-dummies-vote.marcospaulo.dev.br
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: ai-for-dummies-vote
-                port:
-                  number: 80