feat(curator): deploy the phase-0 system prompt, and correct a misleading README figure

The workspace now holds .pi/SYSTEM.md and .pi/APPEND_SYSTEM.md and nothing else.

SYSTEM.md is rewritten for what is actually deployed. The version committed in
07dd648 described five tools that will not exist until phase 3; shipping it would
have invited the model to call tools it does not have. The capability section now
states plainly that the agent has no tools and that every fact arrives in the
request. The phase-3 target, including the full tool-bearing launch contract, is
recorded in the plan as §4b together with why each part cannot be enabled sooner.

profile.toml likewise describes the deployed configuration rather than the target,
so that deploy-scenario.sh validates against reality and the path check means
something.

Recovered from the retired SKILL.md and folded into SYSTEM.md: the rule that the
current request's schema and length limits override everything else, and that a
JSON task returns exactly one JSON value with no fences. Phase 0's four prompt
types all depend on it, and it was the one part of that file not already covered.

Measured before and after on the real workspace, with flags read from the code
rather than transcribed (docs/evidence/2026-08-27-curator-phase0-prompt.md):

- expert coding assistant framing: present -> gone
- pointer to pi's own documentation: present -> gone
- the 64-line media policy: absent -> present
- workspace AGENTS.md: loaded -> blocked
- parent-directory AGENTS.md: LEAKED -> blocked
- <available_skills>: absent both times

Two things this confirms on the production configuration rather than a synthetic
probe. --skill was genuinely a no-op: it pointed at a real 64-line SKILL.md and
the skills block was still absent, because pi emits it only when a tool named
read is active and --no-tools deactivates everything. And --no-context-files is
the only switch that stops parent-directory pollution: a marker planted in
/home/claw/pi-workspaces/AGENTS.md reached the prompt before and not after.

Deleting the now-dead AGENTS.md and SKILL.md from the workspace changed the
prompt length by zero bytes, which is the proof that they were dead.

README corrected. Its table cited 960 characters as Curator's system prompt after
the change; that figure came from a few-line stub SYSTEM.md in the isolation
probe, and the real prompt is 3539 -- larger, not smaller. Presenting the stub
measurement as Curator's was misleading, and "72% smaller" was wrong. The prompt
grew because roughly 1.9 KB of pi scaffolding was replaced by domain policy that
had never loaded at all. The mechanism claim is unaffected.

scenarios/curator/profile.toml

@@ -1,13 +1,16 @@
 # curator — Pi scenario profile
 #
-# STATUS: target configuration. The live service does NOT yet run this; it is
-# still on the pre-refactor launch parameters. Switching over happens in plan
-# phase 3 (docs/plans/2026-08-curator-agent-refactor.md).
+# This file describes the configuration that is DEPLOYED. The phase-3 target,
+# with tools, skills and a long-lived RPC session, is recorded in
+# docs/plans/2026-08-curator-agent-refactor.md §4b, together with why each part
+# cannot be enabled earlier.
 #
-# This file is the single source of truth for the launch contract.
-# scripts/deploy-scenario.sh renders it into <workspace>/.pi/launch.json, and
-# curator/pi_agent.py MUST read that file and fail closed if it is missing:
-# silently running without --no-extensions would widen the agent's reach.
+# Current state: plan phase 0 (stop the bleeding). The agent has no tools; the
+# Curator service gathers every fact and the model only classifies or phrases.
+#
+# The launch contract lives here. Phase 3 makes curator/pi_agent.py read the
+# rendered .pi/launch.json and fail closed if it is missing; until then
+# pi_agent._isolation_args() is the enforcement point and must match this file.
 
 [scenario]
 name        = "curator"
@@ -18,110 +21,72 @@ service     = "curator.service"
 # Application code lives in a separate repository and is intentionally outside
 # the agent's workspace.
 backend     = "/home/claw/codex-workspace/server-management/deploy/curator"
+deploy      = "managed"
 
 [model]
 provider = "zenmux"
 primary  = "openai/gpt-5.6-luna"
 fallback = "x-ai/grok-4.6"
 
-# One global thinking level was the dominant p50 latency contributor: intent
-# classification ran at "high" at the front of every message. Differentiate.
 [model.thinking]
-conversation = "high"
-extraction   = "low"
-synthesis    = "medium"
+# One level for every call. Intent classification runs at "high" at the front of
+# every message, which is the dominant p50 latency contributor; splitting the
+# levels per role needs the RPC client's set_thinking_level (phase 3).
+all = "high"
 
 [session]
-# Per Telegram chat. The client appends a rotation counter, so history stays
-# greppable on disk instead of being summarised away.
-id_prefix             = "curator-tg"
-rotate_after_prompts  = 20
-rotate_after_messages = 50
-strategy              = "session-id"
+# One pi process per message, keyed by Telegram chat via a uuid5 of the chat id.
+# No rotation: the process does not outlive the message. Phase 3 replaces this
+# with a long-lived RPC process plus explicit rotation.
+strategy = "process-per-message"
 
 [isolation]
-# Verified combination — see docs/evidence/. Result: no coding-assistant
-# framing, no pi-docs block, no parent-directory context pollution, only this
-# scenario's own skills, only this scenario's own tools.
-no_builtin_tools    = true   # not --tools: a registry allowlist would block
-                             # tools registered dynamically from the backend
+# Enforced in curator/pi_agent.py::_isolation_args. Verified effect is recorded
+# in docs/evidence/2026-08-27-curator-phase0-prompt.md.
+no_tools            = true   # phase 0 only. Also disables the skills mechanism:
+                             # pi emits <available_skills> only when a tool named
+                             # `read` is active, so --skill was a no-op and the
+                             # media policy never reached the model. The policy
+                             # now lives in the system-prompt files below.
 no_extensions       = true
 no_skills           = true
 no_prompt_templates = true
 no_themes           = true
 no_context_files    = true   # the ONLY switch that stops parent-dir AGENTS.md;
                              # AGENTS.override.md does not (verified)
-approve             = true   # required to load .pi/SYSTEM.md and .pi/settings.json
+approve             = true   # required to load .pi/SYSTEM.md
 
 [personality]
 # Both are system-prompt files, so --no-context-files does not affect them.
 system_prompt        = ".pi/SYSTEM.md"          # replaces pi's default prompt
 append_system_prompt = ".pi/APPEND_SYSTEM.md"   # durable domain responsibilities
-context_files        = []                        # deliberately none
+context_files        = []                       # deliberately none
 
 [resources]
-extensions = [".pi/extensions/curator-tools.ts"]
-skills = [
-  ".pi/skills/curator-core",
-  ".pi/skills/video-arr",
-  ".pi/skills/books-ingest",
-]
+# Nothing is loaded from disk beyond the two system-prompt files.
+extensions = []
+skills     = []
 
 [tools]
-# Enforced twice: setActiveTools plus a tool_call block, both inside
-# curator-tools.ts. The CLI is not the security boundary.
-#
-# `read` is a restricted override from shared/extensions/pi-guard-base.ts. It is
-# mandatory, not optional: pi emits the skills section only when a tool named
-# `read` is active, and skill bodies load through it.
-allow = [
-  "read",
-  "curator_query_library",
-  "curator_lookup_online",
-  "curator_book_reviews",
-  "curator_counts",
-  "curator_propose_write",
-]
-
-# Structured-output tools, used only by the stateless extraction/synthesis calls
-# (--no-session). They carry constrainedSampling + terminate.
-structured_output = ["emit_extraction", "emit_reviews"]
-
-# The agent cannot write. curator_propose_write only records a planned Plan and
-# echoes the resolved identity; the deterministic policy engine in
-# curator/service.py decides whether it executes. Receipts are harvested from
-# tool_execution_end, never phrased by the model.
-receipt_tools = []
-
-[tools.read_policy]
-# Must include the skill directories or skill bodies become unloadable.
-roots      = [".pi/skills"]
-extensions = [".md"]
-max_chars  = 40000
-
-[bridge]
-# Loopback only, with a secret generated at service start and passed through env.
-# pi-guard-base asserts the host is loopback and refuses anything else.
-host = "127.0.0.1"
-port = 8767
-# The backend serves tool definitions as JSON Schema at /tools so that the schema
-# has exactly one owner; registerTool accepts a plain JSON Schema object.
-spec_endpoint = "/tools"
+allow = []
 
 [budget]
-# Per-invocation timeouts do not compose: the old configuration could spend
-# 4 x 120 s on a single message with no overall bound. One deadline per user
-# message, enforced with RPC abort.
-turn_deadline_seconds       = 180
-extraction_deadline_seconds = 120
-startup_timeout_seconds     = 60
+# One timeout per pi invocation. These do not compose: a single message can run
+# interpret + query + answer, so the worst case is a multiple of this value.
+# Phase 3 introduces one deadline per user message, enforced with RPC abort.
+invocation_timeout_seconds = 120
 
 [env]
-# Explicit allowlist. Notably absent: every CURATOR_* credential. The provider
-# key is read by pi itself from ~/.pi/agent/models.json.
+# Explicit allowlist, enforced in pi_agent.ENV_ALLOWLIST. Notably absent: every
+# CURATOR_* credential, including the Telegram bot token and the Radarr, Sonarr,
+# Plex and Tavily keys. The provider key is read by pi itself from
+# ~/.pi/agent/models.json and does not travel through the environment.
 minimal   = true
-allowlist = ["PATH", "HOME", "LANG", "LC_ALL", "TZ", "SSL_CERT_FILE", "SSL_CERT_DIR"]
-extra     = ["PI_TOOL_BRIDGE_URL", "PI_TOOL_BRIDGE_TOKEN"]
+allowlist = [
+  "PATH", "HOME", "LANG", "LC_ALL", "LC_CTYPE", "TZ",
+  "NODE_OPTIONS", "SSL_CERT_FILE", "SSL_CERT_DIR", "NO_PROXY", "no_proxy",
+]
+extra     = []
 
 [secrets]
 env_file = "/home/claw/.config/curator/curator.env"