fix: replace LXC/LXD with Incus

Replace all /snap/bin/lxc references with incus in the
hertz-specific tool definitions. Tool names changed from
lxc_exec/lxc_list to incus_exec/incus_list.

Context: LXC snap was removed from hertz; the system
now uses incus (Debian package) for container management.

tools.d/hertz.lua

@@ -0,0 +1,256 @@
+-- /opt/lmcp/tools.d/hertz.lua — hertz-specific tool registrations.
+--
+-- Invoked by the packaged server.lua's tools.d scan (lmcp ≥ v1.2.0, issue #22).
+-- Receives (server, run) — the configured lmcp instance and the
+-- coroutine-aware run() helper. We add hertz-only tools on top of the
+-- packaged generics (shell, read_file, write_file, edit_file, list_dir,
+-- search_files, fetch, web_search, shell_bg).
+--
+-- Previously these all lived in /opt/lmcp/server.lua (a copy-paste fork of
+-- the packaged server.lua). That pattern drifted on every release; now the
+-- packaged file stays canonical and only the genuine hertz-specifics live
+-- here.
+
+local server, run = ...
+
+-- Local helpers — single-host scoped, not worth lifting into the packaged lib.
+local function read_file_raw(path)
+    local f = io.open(path, 'r')
+    if not f then return nil end
+    local c = f:read('*a'); f:close(); return c
+end
+
+local function farad(cmd, timeout)
+    return run("incus exec farad -- sh -c " .. string.format("%q", cmd),
+        timeout or 15)
+end
+
+-- ---- LXD tools ----
+
+server:tool("incus_exec", "Execute a command inside an Incus container on hertz.", {
+    type = "object",
+    properties = {
+        container = { type = "string", description = "Container name" },
+        command   = { type = "string", description = "Command to execute" },
+        timeout   = { type = "integer", default = 30 },
+    },
+    required = { "container", "command" },
+}, function(a)
+    return run(string.format("incus exec %s -- sh -c %q",
+        a.container:gsub("[^%w%-]", ""), a.command), a.timeout or 30)
+end)
+
+server:tool("incus_list", "List all Incus containers on hertz.",
+    { type = "object" },
+    function() return run("incus list -c ns4 -f csv", 10) end)
+
+-- ---- Fritz!Box tools ----
+
+server:tool("fritz", "Execute Fritz!Box TR-064 command (info, hosts, wan, "
+    .. "wol <mac>, reconnect, reboot, reboot-repeater <ip>, routes, route-add, "
+    .. "route-del, services, actions, call).",
+    {
+        type = "object",
+        properties = {
+            command = { type = "string", description = "fritz subcommand and args" },
+        },
+        required = { "command" },
+    },
+    function(a) return run("sudo /root/.local/bin/fritz " .. a.command, 15) end)
+
+-- ---- Network tools ----
+
+server:tool("ping_host", "Check if a host is reachable (1 ICMP ping, 2s timeout).", {
+    type = "object",
+    properties = { host = { type = "string" } },
+    required = { "host" },
+}, function(a)
+    local host = a.host:gsub("[^%w%.%-:]", "")
+    return run("ping -c1 -W2 " .. host, 5)
+end)
+
+server:tool("network_status",
+    "Check reachability of all infrastructure hosts and MCP endpoints.",
+    { type = "object" },
+    function()
+        local script = [[
+hosts="hertz:localhost boltzmann:boltzmann tesla:tesla data:192.168.88.30 broglie:192.168.88.160 higgs:10.170.16.10"
+for entry in $hosts; do
+    name="${entry%%:*}"
+    ip="${entry#*:}"
+    if ping -c1 -W2 "$ip" >/dev/null 2>&1; then
+        status="UP"
+        if [ "$name" != "data" ]; then
+            if timeout 3 bash -c "echo >/dev/tcp/${ip}/8080" 2>/dev/null; then
+                status="UP (MCP ok)"
+            else
+                status="UP (no MCP)"
+            fi
+        fi
+    else
+        status="DOWN"
+    fi
+    printf "%-12s %-20s %s\n" "$name" "$ip" "$status"
+done
+]]
+        return run(script, 30)
+    end)
+
+server:tool("wol_and_wait",
+    "Wake the data server via Fritz!Box WoL and wait until it (or broglie MCP) is reachable.",
+    {
+        type = "object",
+        properties = {
+            mac          = { type = "string",  default = "", description = "MAC address (auto-detected if empty)" },
+            wait_for_mcp = { type = "boolean", default = true, description = "Wait for broglie MCP instead of just ping" },
+            timeout      = { type = "integer", default = 120 },
+        },
+    },
+    function(a)
+        local mac = a.mac
+        if not mac or mac == "" then
+            local hosts_out = run("sudo /root/.local/bin/fritz hosts 2>/dev/null | grep -i 'data\\|192.168.88.30'", 10)
+            mac = hosts_out and hosts_out:match("(%x%x:%x%x:%x%x:%x%x:%x%x:%x%x)") or ""
+            if mac == "" then return "Error: could not detect MAC for data. Provide it manually." end
+        end
+        run("sudo /root/.local/bin/fritz wol " .. mac:gsub("[^%x:]", ""), 10)
+
+        local timeout = a.timeout or 120
+        local check
+        if a.wait_for_mcp == false then
+            check = "ping -c1 -W2 192.168.88.30"
+        else
+            check = "timeout 3 bash -c 'echo >/dev/tcp/192.168.88.160/8080'"
+        end
+        local target = (a.wait_for_mcp == false) and "data" or "broglie:8080"
+
+        local elapsed = 0
+        while elapsed < timeout do
+            os.execute("sleep 5")
+            elapsed = elapsed + 5
+            local rc = os.execute(check)
+            if rc == true or rc == 0 then
+                return string.format("WoL sent to %s. %s reachable after %ds.",
+                    mac, target, elapsed)
+            end
+        end
+        return string.format("WoL sent to %s but %s not reachable after %ds.",
+            mac, target, timeout)
+    end)
+
+-- ---- Proxmox fallback ----
+
+server:tool("pct_exec",
+    "Execute a command in a Proxmox CT on data (SSH fallback when broglie is down).",
+    {
+        type = "object",
+        properties = {
+            ctid    = { type = "string", description = "Container ID (e.g. 108, 165)" },
+            command = { type = "string" },
+            timeout = { type = "integer", default = 30 },
+        },
+        required = { "ctid", "command" },
+    },
+    function(a)
+        local ctid = a.ctid:gsub("[^%d]", "")
+        return run(string.format("ssh -o ConnectTimeout=5 root@data 'pct exec %s -- sh -c %q'",
+            ctid, a.command), a.timeout or 30)
+    end)
+
+-- ---- Home Assistant ----
+
+server:tool("ha_cli",
+    "Run Home Assistant CLI command inside farad (e.g. 'core restart', 'backups list', 'info').",
+    {
+        type = "object",
+        properties = {
+            command  = { type = "string", description = "ha subcommand, e.g. 'core restart', 'supervisor info', 'backups list'" },
+            raw_json = { type = "boolean", default = false, description = "Return raw JSON output" },
+        },
+        required = { "command" },
+    },
+    function(a)
+        local flags = a.raw_json and " --raw-json" or ""
+        return farad("ha " .. a.command .. flags)
+    end)
+
+server:tool("ha_api",
+    "Call Home Assistant Core REST API. Requires token in /opt/lmcp/ha_token on hertz.",
+    {
+        type = "object",
+        properties = {
+            method   = { type = "string", default = "GET" },
+            endpoint = { type = "string", description = "/api/states, /api/services/climate/set_temperature, etc." },
+            body     = { type = "string", description = "JSON body for POST" },
+        },
+        required = { "endpoint" },
+    },
+    function(a)
+        local token = read_file_raw("/opt/lmcp/ha_token")
+        if not token or token == "" then
+            return "Error: no HA token. Create a long-lived token in HA UI → Profile → "
+                .. "Long-Lived Access Tokens, then: echo '<token>' | sudo tee /opt/lmcp/ha_token"
+        end
+        token = token:gsub("%s+", "")
+        local method = (a.method or "GET"):upper()
+        local cmd = string.format(
+            "curl -sf -X %s -H 'Authorization: Bearer %s' -H 'Content-Type: application/json'",
+            method, token)
+        if a.body and a.body ~= "" then
+            cmd = cmd .. " -d " .. string.format("'%s'", a.body:gsub("'", "'\\''"))
+        end
+        cmd = cmd .. " http://localhost:8123" .. a.endpoint
+        return farad(cmd, 15)
+    end)
+
+-- ---- MQTT (Eurotronic thermostats + general) ----
+
+server:tool("mqtt_pub", "Publish an MQTT message (via Mosquitto in farad).", {
+    type = "object",
+    properties = {
+        topic   = { type = "string" },
+        message = { type = "string" },
+        retain  = { type = "boolean", default = false },
+    },
+    required = { "topic", "message" },
+}, function(a)
+    local retain = a.retain and "-r " or ""
+    return farad(string.format("mosquitto_pub %s-t '%s' -m '%s'",
+        retain, a.topic:gsub("'", "'\\''"), a.message:gsub("'", "'\\''")))
+end)
+
+server:tool("mqtt_sub",
+    "Subscribe to MQTT topics and collect messages (via Mosquitto in farad).",
+    {
+        type = "object",
+        properties = {
+            topic   = { type = "string",  description = "Topic pattern, e.g. 'eurotronic/#' or '#'" },
+            count   = { type = "integer", default = 10, description = "Number of messages to collect" },
+            timeout = { type = "integer", default = 5,  description = "Seconds to wait" },
+            verbose = { type = "boolean", default = true, description = "Show topics with messages" },
+        },
+        required = { "topic" },
+    },
+    function(a)
+        local v = a.verbose ~= false and "-v " or ""
+        return farad(string.format("mosquitto_sub %s-t '%s' -C %d -W %d",
+            v, a.topic:gsub("'", "'\\''"), a.count or 10, a.timeout or 5),
+            (a.timeout or 5) + 5)
+    end)
+
+-- ---- Mediagrab (kids show downloader) ----
+
+server:tool("mediagrab",
+    "Manage kids show downloads in doppler container. Commands: list, weekly, "
+    .. "archive, test <url>, add '<json>'",
+    {
+        type = "object",
+        properties = {
+            command = { type = "string", description = "Command: list, weekly, archive, 'test <url>', 'add <json>'" },
+        },
+        required = { "command" },
+    },
+    function(a)
+        return run("incus exec doppler -- python3 /opt/mediagrab/mediagrab.py "
+            .. a.command, 120)
+    end)