feat: conversation review — a nightly report on a supervised person's conversations

The first AgentScope::PerSubject system agent, and the reason that scope
exists. Once a night, for each person with a supervision edge, it reads every
message that person and the assistant exchanged since the previous review —
across all their conversations — and writes one report for the people who
supervise them.

Schema (all registry except reports):
- supervision(subject_user_id, supervisor_user_id): the generic §0.1 edge,
  answering both 'whom does a background agent look at' and 'who may read
  what it produced', with real FKs so deleting a user cascades both ways
- system_agent_coverage(agent_id, subject_user_id, covered_through): the
  per-subject watermark that makes 'everything since last time' a window —
  neither system_agent_runs (history for humans) nor system_agent_state
  (advances before the work), and advanced only on a completed pass so a
  crash re-covers instead of skipping
- reports (owner schema, the second two-homes table after memory_docs):
  instance rows land in system.db, deliberately cleartext to the box owner,
  who is the intended reader (§2); the subject cannot see them structurally

The pass reads the subject's database inside a supervisor's runtime, so the
ephemeral session and run row land in the watcher's file; iteration is over
subjects, so two parents watching one child get one review; and the subject
need not be logged in when their space is unencrypted — via the new
UserManager::open_unencrypted, which refuses an encrypted user outright (no
key to be had) and never registers the pool as unlocked.

The agent declares the new AgentMeta flag allow_tools: false, so its turn
gets an empty tool registry — nothing for a prompt injection in the
transcript to call — and produces its report as its final assistant message,
read back from chat_history and parsed (NOTHING_TO_REPORT sentinel, no row on
quiet days). chat_history::conversation_window is the transcript query; its
four filters (non-ephemeral, depth 0, non-synthetic, non-empty) each guard a
specific way the review would otherwise be wrong, and tool calls are absent
by construction.

Cadence is Run at (hour) rather than Interval — 4am local by default — with
due-ness answered inside has_work against the coverage watermark, so a
machine off for three days covers the whole stretch in one pass. Reports
announce ReportCreated on the system bus (no subscriber yet). run_ephemeral_turn
gains a per-pass system_substitutions map, which the review uses to hand the
model the subject's profile under __SUBJECT_PROFILE__ — the system-context
substitutions describe the session owner, the wrong person here.

docs/system-agents.md gains the conversation review section; CLAUDE.md
documents the scope, the tables and the tool-less design.

crates/skald-core/src/loop_adapters/runtime.rs

@@ -244,8 +244,22 @@ impl UserLoopRuntime {
             datetime:       self.config.datetime.clone(),
         });
 
+        // The agent's own declarations. Loaded once here and used twice below —
+        // for the tool set and for the selector's strength floor.
+        let meta = crate::agents::load_meta(&frame_agent).ok();
+
         // ── Tool set: the native tools, then the surface's legacy ones ──
-        let tools = self.build_toolset(&scope, config);
+        //
+        // Unless the agent declares it gets none. An empty set is not the same as
+        // a restrictive permission group: a group decides whether a call is
+        // allowed, this decides whether the model is shown anything to call. For
+        // an agent that reads material and answers in prose — a review, a
+        // summariser — that is the difference between gating an action and there
+        // being no action available.
+        let tools = match meta.as_ref() {
+            Some(m) if !m.allow_tools => Arc::new(agent_loop::tool::ToolRegistry::new()) as Arc<dyn ToolSet>,
+            _                         => self.build_toolset(&scope, config),
+        };
 
         // ── Assembler: the shared projection, scoped to this session's DTL ──
         let assembler = Arc::new(skald_assembler(
@@ -270,7 +284,7 @@ impl UserLoopRuntime {
         extensions.insert(scope.clone());
 
         // ── Selector: this agent's strength (D14) + the owner's request log ──
-        let strength = crate::agents::load_meta(&frame_agent).ok().and_then(|m| m.strength);
+        let strength = meta.and_then(|m| m.strength);
         let selector: Arc<dyn ModelSelector> = Arc::new(
             SkaldSelector::new(self.llm_manager.clone(), strength).with_log(self.log_target()),
         );