Remove the custom relay and its release infrastructure #882

Parent

#868

What to build

Complete the coordinated greenfield cutover so supported CLI and Cloud RPC paths use SSH/local or Tailcat and the custom relay is no longer built, configured or deployed. Delete the old implementation rather than retaining a compatibility backend.

Acceptance criteria

• Delete the relay crate/process, Register/Open/Attach protocol, tenant slots, tunnel IDs, byte splicing, client and daemon hold/reconnect loop. Preserve Machine RPC Register and other actual Machine RPC operations.
• Delete Relay List/Revoke bindings, relay-only SDK exports/credentials/config, forwarding-only tests, held enrollment leftovers and duplicate connection attempts. Keep authorization, encryption, transactions and OrganizationRuntime.open.
• Delete relay image, build/publish/verification jobs, deployment configuration, Dial Credential and relay URL environment variables. Ensure supported releases package only the selected native helper and existing Machine lifecycle.
• Update design/glossary/ADRs to supersede relay/slot/hold decisions. Connection records remain metadata, never Cloud-owned Cluster truth. Preserve SSH/local config, host verification and supported auxiliary commands.
• Rung 1 — build/config/artifact contracts and repository search for active relay references; Rung 2/3 — existing semantic and CLI surface checks. Report actual net production code, dependency and artifact changes, excluding fixtures/vendor code; the parent estimate is not a savings guarantee.

Blocked by

• Join Machines and use Entry Machine fallback through shared sessions #880
• Revoke Tailcat access through existing pairing removal #881