docs: reachableceo wording sweep per 2026-09-09 direct order

House style: the principal identity is named (reachableceo), never
'the founder'. No behavior change.

https://projects.knownelement.com/issues/942

skills/agent-provisioning/references/cloudron.md

@@ -18,7 +18,7 @@
 - There is NO admin route to reset another user's 2FA (PUT/PATCH/DELETE on
   `/users/<uid>` 2FA variants all 404; the dashboard UI only offers profile
   self-service enrollment). Consequence: TOTP seeds not captured at
-  enrollment are unrecoverable without the founder.
+  enrollment are unrecoverable without reachableceo.
 - Other useful routes seen in the SPA bundle: `/api/v1/tokens`,
   `/api/v1/oidc/clients`, `/api/v1/groups`, `/api/v1/eventlog`,
   `/api/v1/app_passwords`. Verify behavior at runtime before relying on a
@@ -51,10 +51,10 @@ exist (`coo`). Identity emails follow `tsgstaff-<login>@turnsys.com`.
 - Enrollment is profile self-service ONLY. Capture the base32 seed into the
   vault (`sm setfield "<login> Cloudron" totp_seed <seed>`) at enrollment —
   there is no admin reset and no recovery path.
-- Policy RULED (founder, 2026-09-08): TOTP seeds MUST be stored in Bitwarden.
+- Policy RULED (reachableceo, 2026-09-08): TOTP seeds MUST be stored in Bitwarden.
   Enroll 2FA only when the seed is being captured to the vault item in the
   same step. Legacy identities whose seeds were never captured (the whole
-  August batch) are reset-on-sight candidates: founder clears 2FA or hands
+  August batch) are reset-on-sight candidates: reachableceo clears 2FA or hands
   over the seed, then re-enroll with capture.
 
 ---