feat(curator): phase 1 — workspace skills, restricted read, slim prompts

- profile.toml: register 5 workspace skills and review-only restricted read; keep no_skills=true (explicit --skill excludes ~/.agents/skills leak).
- curator-tools.ts: registerRestrictedRead rooted at .pi/skills (.md only, 40k cap); allow read through the guard alongside bridge tools.
- SYSTEM.md/APPEND_SYSTEM.md/SYSTEM.structured.md: slim to a capable-companion identity + safety kernel; describe read outside the generated tool markers; regenerate the 7-tool region.
- skills/{curator-router,books,video,music,sources}/SKILL.md: capable tone, domain workflows, evidence discipline, asymmetric write caution.

scenarios/curator/workspace/.pi/extensions/curator-tools.ts

@@ -23,11 +23,14 @@
  * deploy script overwrites it, and pi-diff.sh reports drift against the repo.
  */
 
+import { resolve } from "node:path";
+
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import {
   fetchBridgeSpecs,
   installGuard,
   registerBridgeTools,
+  registerRestrictedRead,
 } from "./_shared/pi-guard-base.ts";
 
 export default async function activate(pi: ExtensionAPI): Promise<void> {
@@ -50,6 +53,13 @@ export default async function activate(pi: ExtensionAPI): Promise<void> {
   if (specs.length === 0) {
     throw new Error("curator-tools: the bridge served an empty tool list");
   }
+  registerRestrictedRead(pi, {
+    roots: [resolve(process.cwd(), ".pi/skills")],
+    extensions: [".md"],
+    maxChars: 40_000,
+    description:
+      "读取 Curator 已部署的媒体技能说明；仅允许 .pi/skills 下的 Markdown 文件，其他路径一律拒绝。",
+  });
 
   // Deny every built-in tool. --no-builtin-tools is set on the command line too;
   // this is the second lock, because the flag is a launch argument while this is
@@ -57,7 +67,7 @@ export default async function activate(pi: ExtensionAPI): Promise<void> {
   // serves, so a tool cannot be advertised and then blocked.
   installGuard(pi, {
     scenario: "curator",
-    allowedTools: specs.map((spec) => spec.name),
+    allowedTools: [...specs.map((spec) => spec.name), "read"],
     onBlocked: (name: string) =>
       console.error(`curator-tools: blocked built-in tool ${name}`),
   });