docs: reachableceo wording sweep per 2026-09-09 direct order

House style: the principal identity is named (reachableceo), never
'the founder'. No behavior change.

https://projects.knownelement.com/issues/942

skills/agent-provisioning/SKILL.md

@@ -7,7 +7,7 @@ description: >
   schema, and verification. Use whenever asked to "stand up" an identity or
   agent, create/fix Cloudron users, wire SSO, debug identity logins or 2FA,
   or store identity credentials — even if the word "provisioning" is not used.
-  Policy-critical: encodes founder rulings #942 (unique passwords, Cloudron-only
+  Policy-critical: encodes reachableceo rulings #942 (unique passwords, Cloudron-only
   accounts, no reachableceo credentials).
 ---
 
@@ -19,17 +19,17 @@ Bitwarden vault. The Cloudron is the ONLY identity source: never create local
 accounts in Redmine, Gitea, Discourse, or GLPI — the system account comes into
 existence when the identity completes its first SSO login there.
 
-## Non-negotiable policy (founder rulings — violating these invalidates the work)
+## Non-negotiable policy (reachableceo rulings — violating these invalidates the work)
 
 1. **Unique password per identity.** One identity, one password, used only for
    its Cloudron account. Shared passwords are banned (Redmine #942).
 2. **Cloudron-only accounts.** System access = SSO first-login. No local
    accounts, no admin-created users in the downstream systems.
 3. **Never use reachableceo credentials.** Items like `creds/gitea-admin`,
-   `creds/gitea`, `creds/redmine` are the founder's personal accounts and
+   `creds/gitea`, `creds/redmine` are reachableceo's personal accounts and
    carry RESTRICTED notes. If an auth test resolves to user `reachableceo`,
-   stop — you are holding the founder's identity.
-4. **TOTP seeds MUST be stored in Bitwarden** (founder ruling 2026-09-08).
+   stop — you are holding reachableceo's identity.
+4. **TOTP seeds MUST be stored in Bitwarden** (reachableceo ruling 2026-09-08).
    Enroll TOTP and write the base32 seed to the vault item in the same
    breath — a seed that is not in the vault is treated as lost, because
    there is no admin 2FA reset on this Cloudron and no other record exists.
@@ -42,9 +42,9 @@ existence when the identity completes its first SSO login there.
 
 ## Scope check
 
-Identity stand-up is the COO C2 lane's assigned program (founder directive,
+Identity stand-up is the COO C2 lane's assigned program (reachableceo directive,
 2026-09-08). If your chat runs in another lane (SRE, security, OAM), confirm
-the founder assigned the stand-up to you before executing, or route a ticket
+reachableceo assigned the stand-up to you before executing, or route a ticket
 to the COO C2 lane instead.
 
 ## Admin lever: Cloudron API token
@@ -70,8 +70,8 @@ seed was lost, then re-enroll with capture. Admin password set:
 ### 0. Prerequisites
 
 - Vault reachable: `sm get creds/cloudron` works (see references/vault.md).
-- For a NEW Cloudron user: the founder generates the invite, or you create the
-  user via the admin token if the founder has authorized self-service.
+- For a NEW Cloudron user: reachableceo generates the invite, or you create the
+  user via the admin token if reachableceo has authorized self-service.
 - A Redmine ticket to record the work (create one if none exists).
 
 ### 1. Cloudron account (unique password)
@@ -114,7 +114,7 @@ by a real TOTP login (a totpToken in a login is silently ignored for users
 without 2FA — "success" there proves nothing).
 
 If the identity already has 2FA enforced and no seed exists anywhere: STOP and
-ask the founder. There is no programmatic recovery (verified 2026-09-08).
+ask reachableceo. There is no programmatic recovery (verified 2026-09-08).
 Compute codes offline when needed: `scripts/totp.sh <seed>`.
 
 ### 3. TOTP enrollment (in the identity's dashboard session)
@@ -155,7 +155,7 @@ success.
   `POST /api/v1/users/<login>/tokens` using the session (requires basic auth
   of the same user for token endpoints).
 - **Discourse**: user API key flow; or admin-generated key if an admin lever
-  is ever provided (none currently is — do not use founder keys).
+  is ever provided (none currently is — do not use reachableceo keys).
 - **GLPI**: My account → API token (personal token); pair with the app token
   from `creds/glpi` (password field) for REST calls.