feat(curator): phase 1 — workspace skills, restricted read, slim prompts

- profile.toml: register 5 workspace skills and review-only restricted read; keep no_skills=true (explicit --skill excludes ~/.agents/skills leak).
- curator-tools.ts: registerRestrictedRead rooted at .pi/skills (.md only, 40k cap); allow read through the guard alongside bridge tools.
- SYSTEM.md/APPEND_SYSTEM.md/SYSTEM.structured.md: slim to a capable-companion identity + safety kernel; describe read outside the generated tool markers; regenerate the 7-tool region.
- skills/{curator-router,books,video,music,sources}/SKILL.md: capable tone, domain workflows, evidence discipline, asymmetric write caution.

scenarios/curator/profile.toml

@@ -2,8 +2,8 @@
 #
 # This file describes the configuration that is DEPLOYED.
 #
-# Current state: plan phase 3. The agent has five read/propose tools served over a
-# loopback bridge, and one long-lived pi process per Telegram chat.
+# Current state: skill enablement phase 1. The agent has seven read/propose bridge
+# tools, one restricted skill reader, and one long-lived pi process per Telegram chat.
 #
 # The enforcement point is PiLaunchConfig in
 # pi-agent-config/shared/lib/py/pi_rpc.py, built by curator/pi_session.py. The
@@ -18,8 +18,8 @@ workspace   = "/home/claw/pi-workspaces/curator"
 session_dir = "/home/claw/.local/share/pi-curator/sessions"
 service     = "curator.service"
 # Application code lives beside the agent's .pi workspace in its own git repo
-# at /home/claw/pi-workspaces/curator. The agent itself reads only .pi/ and its
-# extensions, never this repository's Python code (no `read` tool).
+# at /home/claw/pi-workspaces/curator. The restricted `read` tool can reach only
+# Markdown under .pi/skills, never the Python backend or credentials.
 backend     = "/home/claw/pi-workspaces/curator"
 deploy      = "managed"
 
@@ -54,7 +54,7 @@ no_builtin_tools    = true   # bash / edit / write stay unreachable, extension
                              # registry and would stop the extension registering
                              # anything at all.
 no_extensions       = true   # ...except the one named under [resources]
-no_skills           = true
+no_skills           = true   # suppress defaults; the five explicit skill paths below still load
 no_prompt_templates = true
 no_themes           = true
 no_context_files    = true   # the ONLY switch that stops parent-dir AGENTS.md;
@@ -83,19 +83,27 @@ extensions         = [".pi/extensions/curator-tools.ts"]
 # Vendored into .pi/extensions/_shared/ by deploy-scenario.sh, because a tracked
 # extension cannot resolve an import from shared/ once installed outside the repo.
 shared_extensions  = ["pi-guard-base.ts"]
-# Deliberately empty, and it is not an oversight. pi emits the skills section only
-# when a tool named `read` is active; Curator's tools are all domain-specific, so
-# every --skill argument would be discarded in silence. Measured: with tools
-# [query_library, lookup_online, counts] the prompt contained no skills section
-# and no skill names, with and without --system-prompt. The media policy lives in
-# APPEND_SYSTEM.md, which is unconditional.
-skills             = []
+# Explicit paths are merged even with no_skills=true. The extension registers a
+# restricted tool named `read`, which makes pi expose the skills block without
+# making the backend repository or ~/.agents/skills readable.
+skills = [
+  ".pi/skills/curator-router",
+  ".pi/skills/curator-books",
+  ".pi/skills/curator-video",
+  ".pi/skills/curator-music",
+  ".pi/skills/curator-sources",
+]
 
 [tools]
 # Served by the backend at /tools from curator/contracts.py, so the tool the model
 # sees and the endpoint that answers it are the same object. Listed here for
 # review only; this file is not the source.
-allow = ["query_library", "lookup_online", "book_reviews", "counts", "propose_write"]
+# `read` is review-only here: it is extension-registered and is not a backend
+# contract tool served by /tools.
+allow = [
+  "query_library", "lookup_online", "book_reviews", "fetch_source", "web_search",
+  "counts", "propose_write", "read",
+]
 
 [budget]
 # One deadline per user turn, enforced with the RPC abort command rather than by