prism is decommissioned, so social.krebsco.de had no working entry
point while the hotdog container itself kept serving fine on neoprism.

DNS for social.krebsco.de still needs to be repointed to neoprism
before ACME can issue a cert.

Livestreams never played and VOD depends on companion keeping up with
YouTube's po_token and SABR changes, which it does not reliably enough to
be worth the moving parts.

Takes the residential exits with it: tinyproxy on styx and coaxmetal
existed only so neoprism could reach YouTube from a non-Hetzner address.

Leaves the generated companion key in vars/pass, matching how the
silverbullet and oauth2-proxy removals were handled.

Point at Lassulus/tincr fix/pmtu-blackhole-recovery (upstream main plus
the fix) until it lands in Mic92/tincr.

ignavia and coaxmetal sit behind the same NAT, which does not hairpin.
Once a relay hands each the other's reflexive address, every UDP probe
is answered with ICMP port unreachable, and tincr never recovers:
udp_timed_out measured from the probe send rather than the reply, so
the 10s keepalive kept pushing a 30s deadline out of reach and
udp_confirmed stayed pinned; with it pinned, discovery collapsed maxmtu
to 0 and nothing re-armed it, so every cycle re-converged to MTU 0.
Logged as "Fixing MTU of coaxmetal to 0" 201 times in 30 minutes with
the peer unusable, versus once for every healthy peer.

Also carries upstream PRs #13-#20 (riscv64, tincd-compat, default
package, systemd credential loading, multi-user.target).