Revert "merge: apply windows standalone service installer and awHostname hardening"

This reverts commit e643576aa9, reversing
changes made to 669501f20a.

docs/artifacts-policy.md

@@ -1,50 +0,0 @@
-# Artifacts Policy
-
-## Purpose
-
-Define which files are source-of-truth and which are generated runtime/research artifacts that must not block or pollute production rollouts.
-
-## Source of Truth
-
-Tracked and reviewable:
-
-- `ansible/`
-- `aw-server/`
-- `windows/`
-- `scripts/`
-- `docs/`
-- install-kit templates and manifests under `windows/installkit/innosetup/`
-
-## Generated / Volatile Artifacts
-
-Not for production commits:
-
-- `.graphify_*` cache/analysis outputs
-- `graphify-out/cache/*`
-- `graphify-out/shellcheck-*.txt`
-- `graphify-out/validate_dryrun_out*.txt`
-- `graphify-out/powershell-parse-results*.json`
-- `graphify-out/powershell-pssa-warn-results.json`
-- `graphify-out/pssa_diffs.txt`
-- `reports/*`
-- `tmp/*`
-
-These paths are ignored by `.gitignore` and additionally guarded by `scripts/quality-gate.sh`.
-
-## Rollout Gate
-
-`scripts/prod_rollout.sh` must run only when:
-
-1. `AW_MAINTENANCE_ACK=YES` is set.
-2. `scripts/quality-gate.sh` passes.
-3. Preflight checks pass:
-   - `ansible ping`/`win_ping`
-   - `./check-aw-data.sh`
-   - `./check-aw-full.sh`
-
-If any gate fails, rollout stops.
-
-## Notes
-
-- Secrets policy remains temporary by operator choice; credentials may still exist in local `inventory.ini` during this phase.
-- Dedicated secrets hardening (vault/env-only enforcement) is a separate follow-up track.

docs/dlp-aggregator.md

@@ -8,8 +8,6 @@ The prototype reads:
 
 - `aw-file-operations_*` (`aw.file.operation`) — file create/delete/rename telemetry, including `archiveHint`.
 - `aw-dlp-incidents_*` (`aw.dlp.incident`) — browser/endpoint DLP incidents and screenshot metadata when available.
-- `aw-dlp-endpoint-signals_*` (`aw.dlp.endpoint.signal`) — endpoint signal heartbeats/events.
-- `aw-email-monitor_*` (`aw.email.signal`) — outbound email signal stream.
 
 ## SQLite smoke test
 

docs/operations.md

@@ -17,7 +17,6 @@
 - секреты не хранить в git;
 - каждое изменение фиксировать в ticket/run log;
 - публичную публикацию делать через отдельный proxy/security layer.
-- generated-артефакты и исследовательские кэши вести по [artifacts-policy.md](/mnt/usb_hdd2/Projects/ActivityWatch-Russian/docs/artifacts-policy.md).
 
 ## Регулярные проверки
 
@@ -125,4 +124,3 @@ systemctl restart activitywatch-server.service
 - не обновлять поверх рабочего бинарника без backup;
 - не открывать `5600/tcp` наружу без отдельной защиты;
 - не править `index.html` вручную без backup.
-- не запускать `scripts/prod_rollout.sh` без `AW_MAINTENANCE_ACK=YES`.

docs/runbook.md

@@ -196,15 +196,6 @@ systemctl restart activitywatch-server.service
 
 ## Перед любыми изменениями
 
-0. Подтвердить maintenance window и gate:
-
-```sh
-export AW_MAINTENANCE_ACK=YES
-./scripts/quality-gate.sh
-```
-
-Если `quality-gate` падает (например, drift install-kit vs repo), rollout не запускать.
-
 1. Сделать snapshot или `vzdump`.
 2. Сохранить текущий `/etc/activitywatch/aw-server.env`.
 3. Сохранить текущий `index.html`.