feat(ariadne): sweep seven projects, and stop advertising the wrong model

The sweep covered four projects because only four had a write allowlist.
ananke (Go, cmd/ and internal/), pegasus (Go backend, TS frontend) and
atlasbot (Python) all have SonarQube projects and mapped repositories; they
were excluded only for want of prefixes and suffixes, which are now set from
each repository's actual layout.

The per-sweep ceiling rises to seven, one per project. With rule-level dedupe
a project stops producing proposals once every rule it has is already under
review, so this is a ceiling rather than a rate - the backlog cannot become a
queue nobody drains.

The Hermes deployment annotation still advertised gpt-5.6-terra as primary.
The config has had claude-opus-5 as default and primary for some time, so the
annotation was telling operators the wrong thing about which model made a
decision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/hermes/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         app: hermes
       annotations:
         ai.bstein.dev/frontend-fix: scope PTY attachment by selected conversation
-        ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback
+        ai.bstein.dev/model: anthropic/claude-opus-5, falling back to openai-codex/gpt-5.6-terra then local gpt-oss:20b
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred)
         ai.bstein.dev/config-rev: "20260804-root-operator-docs"

services/maintenance/apps/ariadne-deployment.yaml

@@ -572,17 +572,18 @@ spec:
             # discover it has nowhere to write. That excludes ananke, pegasus,
             # atlasbot, data_prepper and titan_iac for now.
             - name: ARIADNE_HERMES_SONAR_PROJECTS
-              value: ariadne=ariadne,metis=metis,soteria=soteria,bstein_home=bstein-dev-home
+              value: ariadne=ariadne,metis=metis,soteria=soteria,bstein_home=bstein-dev-home,ananke=ananke,pegasus=pegasus,atlasbot=atlasbot
             # Hotspots are absent by construction - they need human review, not a
             # patch - so only findings with a code fix are ever requested.
             - name: ARIADNE_HERMES_SONAR_TYPES
               value: CODE_SMELL,BUG
-            # One per project per hourly sweep, four projects. A backlog of 139
-            # findings turned into 139 pull requests would make the review gate
-            # theatre, so this stays far below what the backlog could produce;
-            # the 64-open-proposal ceiling above still applies on top.
+            # One per project per hourly sweep across seven projects. Rule-level
+            # dedupe means a project stops producing proposals once every rule
+            # it has is already under review, so this is a ceiling rather than a
+            # rate: the backlog cannot turn into a pull request queue nobody
+            # drains. The 64-open-proposal ceiling still applies on top.
             - name: ARIADNE_HERMES_SONAR_MAX_PER_SWEEP
-              value: "4"
+              value: "7"
             # SonarQube's own effort estimate is the filter, not severity: it is
             # the closest proxy for the single anchored change the patch
             # validator can check. Anything it calls longer than this is a
@@ -594,9 +595,9 @@ spec:
             - name: ARIADNE_HERMES_CODE_BASE_BRANCHES
               value: metis=master,lesavka=master,soteria=main,bstein-dev-home=master,ariadne=master,ananke=main,pegasus=main,atlasbot=main
             - name: ARIADNE_HERMES_CODE_PREFIXES
-              value: metis=cmd/|pkg/,lesavka=server/|client/|common/,soteria=cmd/|internal/,bstein-dev-home=backend/|frontend/,ariadne=ariadne/
+              value: metis=cmd/|pkg/,lesavka=server/|client/|common/,soteria=cmd/|internal/,bstein-dev-home=backend/|frontend/,ariadne=ariadne/,ananke=cmd/|internal/,pegasus=backend/|frontend/,atlasbot=atlasbot/
             - name: ARIADNE_HERMES_CODE_SUFFIXES
-              value: metis=.go,lesavka=.rs,soteria=.go,bstein-dev-home=.py|.ts|.tsx|.js,ariadne=.py
+              value: metis=.go,lesavka=.rs,soteria=.go,bstein-dev-home=.py|.ts|.tsx|.js,ariadne=.py,ananke=.go,pegasus=.go|.ts|.tsx|.js,atlasbot=.py
             - name: ARIADNE_HERMES_GITEA_TOKEN
               valueFrom:
                 secretKeyRef: