docs: purge stale lamassu naming; fix the hal-check skill's provenance boundary

- @lamassu/clink import examples → @bitSpire/clink, the package's real name.
- machine-installation.md: the service user is `bitspire`, not `lamassu`
  (renamed in configuration.nix long ago; the doc never followed).
- README: clone aiolabs/bitspire, not lamassu-next; the fleet sentence
  claiming batm3/douro run `main` against Lightning.Pub was stale.
- nostr-check skill: table headers say bitSpire.
- hal-check skill: the boundary is c0b69d1, not v8.1.5 (CLAUDE.md corrected
  this 2026-07-04; the skill kept asserting the wrong tag), and the
  "forbidden operations" now reflect the recorded permission —
  reference over port, name the source commit — plus a rule born of the
  GTQ window: no value table without a test over it.

Deliberately kept: every `aiolabs/lamassu-next#NN` issue citation, the
provenance sections, "Ported from lamassu-machine" driver headers, and
the hardware names "Lamassu Sintra/Tejo/Douro" — those are the machines.

docs/clink-protocol.md

@@ -68,7 +68,7 @@ noffer1<bech32-encoded-data>
 The ATM wants to receive payment from a customer:
 
 ```typescript
-import { encodeNoffer } from '@lamassu/clink'
+import { encodeNoffer } from '@bitSpire/clink'
 
 // ATM creates a noffer for receiving payment
 const noffer = encodeNoffer({
@@ -134,7 +134,7 @@ ndebit1<bech32-encoded-data>
 The ATM wants to pay the customer (customer inserted cash, wants Bitcoin):
 
 ```typescript
-import { encodeNdebit, formatNdebitUri } from '@lamassu/clink'
+import { encodeNdebit, formatNdebitUri } from '@bitSpire/clink'
 
 // ATM creates an ndebit for the customer to authorize withdrawal
 const ndebit = encodeNdebit({
@@ -438,14 +438,14 @@ import {
   CLINKClient,
   createOfferSuccess,
   createOfferError,
-} from '@lamassu/clink'
+} from '@bitSpire/clink'
 ```
 
 ### Reference Implementation
 
 - [CLINK Protocol Spec](https://github.com/shocknet/clink)
 - [Lightning.Pub](https://github.com/shocknet/Lightning.Pub)
-- [@lamassu/clink](../packages/clink/) - TypeScript implementation
+- [@bitSpire/clink](../packages/clink/) - TypeScript implementation
 
 ## Related NIPs
 

docs/machine-installation.md

@@ -52,7 +52,7 @@ Conceptually:
 | Layer | Source | Purpose |
 |---|---|---|
 | **Kernel + initrd** | `nixpkgs` 24.11 + `upboard.nix` initrd modules | Boot the Sintra hardware (eMMC via `sdhci-acpi`, validator/dispenser at `ttyJ5`/`ttyJ7`) |
-| **NixOS base** | `nixpkgs` 24.11 | systemd, Xorg, openbox, the `lamassu` user, sshd for provisioning |
+| **NixOS base** | `nixpkgs` 24.11 | systemd, Xorg, openbox, the `bitspire` user, sshd for provisioning |
 | **bitspire.service** | `deploy/nixos/bitspire-atm.nix` | systemd unit that launches the Electron kiosk |
 | **The Electron app** | `apps/machine` built into a nix derivation | The actual ATM UI + state machine + Lightning client |
 | **Hardware-specific config** | `deploy/nixos/hardware/upboard.nix` (or `douro.nix`, `batm3.nix`) | udev rules, kernel modules, panel calibration |
@@ -82,11 +82,11 @@ Before flashing a Sintra you'll want:
 
 Once the kiosk is up, useful things to know:
 
-- **Service status:** `ssh lamassu@<atm> 'sudo systemctl status bitspire'`
-- **Live log tail:** `ssh lamassu@<atm> 'sudo journalctl -u bitspire -f'`
+- **Service status:** `ssh bitspire@<atm> 'sudo systemctl status bitspire'`
+- **Live log tail:** `ssh bitspire@<atm> 'sudo journalctl -u bitspire -f'`
 - **Re-provision (e.g., wrong relay URL):** rerun `provision-atm.sh` from the dev box with the new env vars
-- **Push a code change without reflashing:** `nixos-rebuild switch --flake .#sintra-installed --target-host lamassu@<atm> --use-remote-sudo`
-- **Inspect transaction history:** `ssh lamassu@<atm> 'sudo bash /etc/nixos/atm-transactions.sh'` (queries `/var/lib/bitspire/state.db`)
+- **Push a code change without reflashing:** `nixos-rebuild switch --flake .#sintra-installed --target-host bitspire@<atm> --use-remote-sudo`
+- **Inspect transaction history:** `ssh bitspire@<atm> 'sudo bash /etc/nixos/atm-transactions.sh'` (queries `/var/lib/bitspire/state.db`)
 
 ## Related documentation
 

docs/ndebit-cash-in-flow.md

@@ -139,7 +139,7 @@ export const NDEBIT_REGEX = new RegExp(
 
 ```typescript
 // In lib/types/parse.ts
-import type { DebitPointer } from '@lamassu/clink'
+import type { DebitPointer } from '@bitSpire/clink'
 import type { Satoshi } from './units'
 
 export enum InputClassification {
@@ -159,7 +159,7 @@ export interface ParsedNdebitInput {
 
 ```typescript
 // In lib/parse.ts
-import { decodeNdebit } from '@lamassu/clink'
+import { decodeNdebit } from '@bitSpire/clink'
 
 // Add to VALIDATORS array:
 {
@@ -209,7 +209,7 @@ case InputClassification.NDEBIT: {
 ```typescript
 // In State/scoped/backups/sources/history/claimNdebitThunk.ts
 import { getNostrClient } from '@/Api/nostr'
-// Note: SendNdebitRequest is wallet-side code, not part of @lamassu/clink
+// Note: SendNdebitRequest is wallet-side code, not part of @bitSpire/clink
 // This example shows the wallet's implementation pattern
 import { finalizeEvent } from 'nostr-tools'
 import { SimplePool } from 'nostr-tools'
@@ -849,7 +849,7 @@ See "Single-Use Protection" section above for implementation details.
 
 ```json
 {
-  "@lamassu/clink": "workspace:*",
+  "@bitSpire/clink": "workspace:*",
   "nostr-tools": "^2.x.x",
   "@noble/hashes": "^1.x.x",
   "qrcode": "^1.x.x"