fix(protocols): drop a dead link and the stale file behind it

protocols.org pointed at references/calendar-reference.org, which the template rsync never copies. The link was dead in every consuming project. It now points at the four calendar workflows, which do sync. They already carry the tool names, both account ids, and the gcalcli fallback.

The reference file itself is gone. Nothing linked it any more. It existed as two copies that sync-check doesn't gate, and all three credential paths in it had been dead since the OAuth keys moved into the encrypted MCP bundle. protocols.org now names mcp/README.org as the authority instead, in prose rather than a link, so it can't go dead downstream the same way.

I dropped one fact with it on purpose: that the Google Cloud app runs in production mode so tokens don't expire weekly. It's checkable in the console and it was the last live line in the file.

The same defect class turned up at seven more sites in four synced workflows, all reaching outside .ai/ with ../../. I filed those rather than fixing them here. scripts/lint.sh already has a check built for exactly this and misses them because it only matches markdown link syntax.

2 files changed, 3 insertions, 67 deletions

diff --git a/.ai/protocols.org b/.ai/protocols.org
index f4eefed..bf9f420 100644
--- a/.ai/protocols.org
+++ b/.ai/protocols.org
@@ -270,7 +270,9 @@ The queue lives in the session anchor (=.ai/session-context.org=) under a =* Bef
 
 Three ways to access Craig's calendars: Google Calendar MCP (preferred, both personal + work accounts), gcalcli (fallback, personal only), Emacs org files (read-only viewer).
 
-For tool recipes, authentication details, and credentials, see [[file:references/calendar-reference.org][calendar-reference.org]].
+For tool recipes and account details, read the calendar workflows in =.ai/workflows/=: =add-calendar-event.org=, =edit-calendar-event.org=, =delete-calendar-event.org=, =read-calendar-events.org=. They carry the MCP tool names, both account ids, the gcalcli fallback, and the conflict-check discipline.
+
+Credentials are needed only for a re-auth Craig performs himself. The MCP bundle's =mcp/README.org= in the rulesets repo is the authority: =gcp-oauth.keys.json= is gitignored and regenerated at install from a base64 var in the bundle, never committed. Named in prose rather than linked, because that path isn't synced into consuming projects.
 
 
 ** GPG Keys
diff --git a/.ai/references/calendar-reference.org b/.ai/references/calendar-reference.org
deleted file mode 100644
index 5791b08..0000000
--- a/.ai/references/calendar-reference.org
+++ /dev/null
@@ -1,66 +0,0 @@
-#+TITLE: Calendar Reference
-#+AUTHOR: Craig Jennings
-
-Tool recipes, authentication, and credentials for Craig's calendar
-setup. Three access methods, in order of preference.
-
-* Google Calendar MCP Server (preferred for all calendar operations)
-
-Craig has the =@cocal/google-calendar-mcp= MCP server configured at user scope (=~/.claude.json=). It provides full read/write access to Google Calendar via MCP tools.
-
-Two accounts are authenticated:
-- *personal* — craigmartinjennings@gmail.com (primary: "Craig Google")
-- *work* — craig.jennings@deepsat.com (primary: "Craig Deepsat")
-
-MCP tools available:
-- =list-events=, =search-events=, =get-event= — read events
-- =create-event=, =create-events= — add events
-- =update-event= — modify events
-- =delete-event= — remove events
-- =list-calendars=, =list-colors= — calendar metadata
-- =get-freebusy= — check availability
-- =manage-accounts= — add/remove/list authenticated accounts
-- =respond-to-event= — accept/decline invitations
-- =get-current-time= — current time in any timezone
-
-Use =account_id: "personal"= or =account_id: "work"= to specify which account.
-
-Default calendar for adding events: "Craig Google" (personal account).
-
-Calendar workflows are available alongside this reference: add-calendar-event, edit-calendar-event, delete-calendar-event, read-calendar-events.
-
-If re-authentication is needed:
-- Use the =manage-accounts= MCP tool with =action: "add"= and the account nickname
-- OAuth credentials: =~/projects/homelab/assets/gcp-oauth.keys.json=
-- Google Cloud app is in production mode (tokens don't expire after 7 days)
-- See =~/projects/homelab/.ai/gcalcli-setup.org= for Google Cloud project details
-
-* gcalcli (fallback for personal account only)
-
-Craig has =gcalcli= installed via pipx, authenticated to his personal Google account only.
-
-#+begin_src bash
-gcalcli agenda                          # upcoming events
-gcalcli calw                            # weekly view
-gcalcli add --title "..." --when "..." --duration "60"  # add event
-gcalcli search "..."                    # search events
-gcalcli delete "..."                    # delete event
-#+end_src
-
-Use =--calendar "Craig Google"= when adding events.
-
-gcalcli does NOT have access to the work (DeepSat) calendar. Use the MCP server for work calendar operations.
-
-If gcalcli needs re-authentication, credentials are stored in the homelab project: =~/projects/homelab/assets/gcalcli-client-secret.json.gpg= (GPG encrypted).
-
-* Emacs org files (read-only, for viewing schedules)
-
-Craig's calendars are at: =~/.emacs.d/data/*cal.org= (gcal.org, dcal.org, pcal.org)
-
-These files are **READ-ONLY** — NEVER add anything to them.
-
-Use this to:
-- Check meeting times and schedules
-- Verify when events occurred
-- See what's upcoming
-- Note: only updated periodically when Emacs is running — may be stale