rename(547): the server is grimoire — package, image, DB defaults, backups

Step 2 of the Scribe -> Grimoire rename.

- src/scribe -> src/grimoire, and every import, patch target, module path,
  hypercorn entry point and `python -m grimoire.restore` with it; pyproject,
  uv.lock and the frontend package are named grimoire.
- Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service
  runs as grimoire / grimoire_test.
- Compose files default the DB user, database and (prod) volume to grimoire,
  each overridable from .env, so an install created as Scribe keeps its data
  by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME.
- Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar.
  Archives named scribe-* with the scribe-backup-tar manifest still restore
  and are still counted at the destination (folder and S3), with tests.
- Exports, the MCP auth realm, the ASGI scope key and the persistent logger
  carry the new name.

Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1",
because every stored secret was derived under it.

Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is
step 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_note_pipeline.py

@@ -15,10 +15,10 @@ from unittest.mock import MagicMock
 
 import pytest
 
-from scribe.services import retrieval_pipeline as rp
-from scribe.services.lessons import LESSON_NOTE_TYPE
-from scribe.services.retrieval_registry import FAN_OUT_SITES, POINTS
-from scribe.services.retrieval_surfaces import SURFACES
+from grimoire.services import retrieval_pipeline as rp
+from grimoire.services.lessons import LESSON_NOTE_TYPE
+from grimoire.services.retrieval_registry import FAN_OUT_SITES, POINTS
+from grimoire.services.retrieval_surfaces import SURFACES
 from tests.helpers import fake_note
 
 
@@ -86,7 +86,7 @@ def test_every_notes_stage_logs_before_it_can_return():
     """Structural, like the rule arms' guard: no `return` in a notes stage
     precedes its call row. The via-lesson arm's one exception is the return
     before any search runs — nothing was asked, so there is nothing to log."""
-    tree = ast.parse(Path("src/scribe/services/retrieval_pipeline.py").read_text())
+    tree = ast.parse(Path("src/grimoire/services/retrieval_pipeline.py").read_text())
     fns = {n.name: n for n in ast.walk(tree) if isinstance(n, ast.AsyncFunctionDef)}
     for name in ("run_note_arm", "_reserve_note_slot", "run_via_lesson_arm"):
         fn = fns[name]
@@ -257,14 +257,14 @@ def test_every_notes_source_is_registered_and_every_arm_is_tunable():
 
 def test_the_pipelines_fan_out_sites_declare_every_notes_source():
     logged = FAN_OUT_SITES[
-        "scribe/services/retrieval_pipeline.py::record_retrieval(source=source)"]
+        "grimoire/services/retrieval_pipeline.py::record_retrieval(source=source)"]
     surfaced = FAN_OUT_SITES[
-        "scribe/services/retrieval_pipeline.py::record_surfaced(source=source)"]
+        "grimoire/services/retrieval_pipeline.py::record_surfaced(source=source)"]
     assert set(rp.NOTE_SOURCES) <= set(logged)
     assert set(rp.NOTE_SURFACED_SOURCES) == set(surfaced)
     # Not the arm's: the slot whose line it is, and the lookups' own site.
     assert "write_path_semantic" not in FAN_OUT_SITES[
-        "scribe/services/plugin_context.py::record_surfaced(source=arm)"]
+        "grimoire/services/plugin_context.py::record_surfaced(source=arm)"]
 
 
 def test_the_filters_say_which_kinds_and_whose_records():