chore: drop 'Infisical' label from internal references

Strategic naming cleanup. Earlier doc-comments + commit messages framed Rank
4 / Rank 5 / Rank 7 work as 'Rank N of the 2026-05-03 Infisical deep-research
deliverable' — the 'Infisical' qualifier was a holdover from the original
deep-research framing where Infisical (a competing secrets-management
platform) was the comparator. Keeping the comparator's name in our source
adds noise without value; an external reader sees 'Infisical' and assumes a
dependency or shared lineage rather than reading it as the competitive
context it was.

Mechanical sed across 34 files (32 source / docs + 2 follow-up Python passes
to collapse 'deep-research deep-research' duplicates that emerged where the
original phrase wrapped across lines):

  s|Infisical deep-research|deep-research|g
  s|infisical-deep-research-results|deep-research-results-2026-05-03|g
  s|infisical-deep-research-prompt|deep-research-prompt-2026-05-03|g
  s|infisical-deep-research|deep-research|g
  s|Infisical|deep-research|g
  s|deep-research deep-research|deep-research|g  # collapse-pass

Net diff: 63 insertions / 64 deletions across cmd/, docs/, internal/,
migrations/. Pure text substitution; zero behavior change. Code path
unchanged — go vet clean, tests for TestApproval pass on both
internal/service and internal/api/handler packages.

Workspace docs (cowork/) carry the same references and will be swept
separately — they're not under certctl/ git control. The two filename
references (cowork/infisical-deep-research-results.md +
cowork/infisical-deep-research-prompt.md) get renamed alongside that sweep
to deep-research-results-2026-05-03.md /
deep-research-prompt-2026-05-03.md so cross-references in the certctl
repo doc-comments resolve cleanly.

cmd/agent/agent_test.go

@@ -947,7 +947,7 @@ func TestCreateTargetConnector_AllSupportedTypes(t *testing.T) {
 			},
 		},
 		{
-			// Rank 5 of the 2026-05-03 Infisical deep-research deliverable.
+			// Rank 5 of the 2026-05-03 deep-research deliverable.
 			// Region must be a valid AWS region; the connector lazy-loads
 			// the SDK client during ValidateConfig but New() with a populated
 			// region should succeed against the SDK credential chain

cmd/agent/main.go

@@ -907,7 +907,7 @@ func (a *Agent) createTargetConnector(ctx context.Context, targetType string, co
 		return k8s.New(&cfg, a.logger)
 
 	case "AWSACM":
-		// Rank 5 of the 2026-05-03 Infisical deep-research deliverable.
+		// Rank 5 of the 2026-05-03 deep-research deliverable.
 		// AWS Certificate Manager target — SDK-driven (no file I/O).
 		// LoadDefaultConfig handles the standard AWS credential chain
 		// (IRSA / EC2 instance profile / SSO / env vars) without any
@@ -921,7 +921,7 @@ func (a *Agent) createTargetConnector(ctx context.Context, targetType string, co
 		return awsacm.New(ctx, &cfg, a.logger)
 
 	case "AzureKeyVault":
-		// Rank 5 of the 2026-05-03 Infisical deep-research deliverable.
+		// Rank 5 of the 2026-05-03 deep-research deliverable.
 		// Azure Key Vault target — SDK-driven (no file I/O).
 		// DefaultAzureCredential handles the standard Azure credential
 		// chain (managed identity / workload identity / env vars / az

cmd/server/main.go

@@ -268,7 +268,7 @@ func main() {
 	transactor := postgres.NewTransactor(db)
 	certificateService.SetTransactor(transactor)
 
-	// Rank 7 of the 2026-05-03 Infisical deep-research deliverable —
+	// Rank 7 of the 2026-05-03 deep-research deliverable —
 	// issuance approval-workflow primitive. ApprovalRepository +
 	// ApprovalMetrics + ApprovalService construct here; the gate is
 	// activated on CertificateService via SetApprovalService +
@@ -344,8 +344,8 @@ func main() {
 	notificationService := service.NewNotificationService(notificationRepo, notifierRegistry)
 	notificationService.SetOwnerRepo(ownerRepo)
 
-	// Rank 4 of the 2026-05-03 Infisical deep-research deliverable
-	// (cowork/infisical-deep-research-results.md Part 5). Per-policy
+	// Rank 4 of the 2026-05-03 deep-research deliverable
+	// (cowork/deep-research-results-2026-05-03.md Part 5). Per-policy
 	// multi-channel expiry-alert metrics. Same instance is wired into
 	// the notification service (recording side, every
 	// SendThresholdAlertOnChannel call reports its outcome) AND into
@@ -626,7 +626,7 @@ func main() {
 	// Top-10 fix #5 (2026-05-03 audit): Vault PKI token-renewal counter.
 	// Same instance the registry uses to record per-tick results.
 	metricsHandler.SetVaultRenewals(vaultRenewalMetrics)
-	// Rank 4 of the 2026-05-03 Infisical deep-research deliverable:
+	// Rank 4 of the 2026-05-03 deep-research deliverable:
 	// per-policy multi-channel expiry-alert counter. Same instance the
 	// notification service uses to record per-(channel, threshold,
 	// result) outcomes.
@@ -927,7 +927,7 @@ func main() {
 		// docs/acme-server.md for the operator-facing reference.
 		ACME: acmeHandler,
 		// Approvals — issuance approval-workflow primitive. Rank 7 of
-		// the 2026-05-03 Infisical deep-research deliverable. See
+		// the 2026-05-03 deep-research deliverable. See
 		// docs/approval-workflow.md.
 		Approvals: approvalHandler,
 	})