rename Fence to Greywall as GreyHaven sandboxing component

Rebrand the project from Fence to Greywall, the sandboxing layer of the
GreyHaven platform. This updates:

- Go module path to gitea.app.monadical.io/monadical/greywall
- Binary name, CLI help text, and all usage examples
- Config paths (~/.config/greywall/greywall.json), env vars (GREYWALL_*)
- Log prefixes ([greywall:*]), temp file prefixes (greywall-*)
- All documentation, scripts, CI workflows, and example files
- README rewritten with GreyHaven branding and Fence attribution

Directory/file renames: cmd/fence → cmd/greywall, pkg/fence → pkg/greywall,
docs/why-fence.md → docs/why-greywall.md, example JSON files, and banner.

docs/recipes/ci.md

@@ -18,7 +18,7 @@ Goal: make CI steps safer by default: minimal egress and controlled writes.
 Run:
 
 ```bash
-fence --settings ./fence.json -c "make test"
+greywall --settings ./greywall.json -c "make test"
 ```
 
 ## Add only what you need
@@ -26,7 +26,7 @@ fence --settings ./fence.json -c "make test"
 Use monitor mode to discover what a job tries to reach:
 
 ```bash
-fence -m --settings ./fence.json -c "make test"
+greywall -m --settings ./greywall.json -c "make test"
 ```
 
 Then allowlist only:

docs/recipes/git-clone.md

@@ -18,7 +18,7 @@ Goal: allow fetching code from a limited set of hosts.
 Run:
 
 ```bash
-fence --settings ./fence.json git clone https://github.com/OWNER/REPO.git
+greywall --settings ./greywall.json git clone https://github.com/OWNER/REPO.git
 ```
 
 ## SSH clone
@@ -28,5 +28,5 @@ SSH traffic may go through SOCKS5 (`ALL_PROXY`) depending on your git/ssh config
 If it fails, use monitor/debug mode to see what was blocked:
 
 ```bash
-fence -m --settings ./fence.json git clone git@github.com:OWNER/REPO.git
+greywall -m --settings ./greywall.json git clone git@github.com:OWNER/REPO.git
 ```

docs/recipes/npm-install.md

@@ -18,7 +18,7 @@ Goal: allow npm to fetch packages, but block unexpected egress.
 Run:
 
 ```bash
-fence --settings ./fence.json npm install
+greywall --settings ./greywall.json npm install
 ```
 
 ## Iterate with monitor mode
@@ -26,7 +26,7 @@ fence --settings ./fence.json npm install
 If installs fail, run:
 
 ```bash
-fence -m --settings ./fence.json npm install
+greywall -m --settings ./greywall.json npm install
 ```
 
 Then add the minimum extra domains required for your workflow (private registries, GitHub tarballs, etc.).

docs/recipes/pip-poetry.md

@@ -18,19 +18,19 @@ Goal: allow Python dependency fetching while keeping egress minimal.
 Run:
 
 ```bash
-fence --settings ./fence.json pip install -r requirements.txt
+greywall --settings ./greywall.json pip install -r requirements.txt
 ```
 
 For Poetry:
 
 ```bash
-fence --settings ./fence.json poetry install
+greywall --settings ./greywall.json poetry install
 ```
 
 ## Iterate with monitor mode
 
 ```bash
-fence -m --settings ./fence.json poetry install
+greywall -m --settings ./greywall.json poetry install
 ```
 
 If you use private indexes, add those domains explicitly.