P0: workspace scaffold, CI gates, tc-domain, tc-config, tc-db vs real Postgres

- Cargo workspace with 1250-line and no-placeholder CI gates wired first
- tc-domain: id newtypes, SessionKey codec (proptest round-trip), Role,
  GatedCategory (spec §15), AccessPolicy, core entities
- tc-config: figment TOML+env config, DeployTarget/provider/auth selection
  with semantic validation
- migrations/0001: full spec §14 schema incl. DB-enforced append-only audit_log
- tc-db: compile-time-checked sqlx repos (workspaces, users, agents+policies,
  credits, audit) with committed .sqlx offline metadata
- tc-testkit: per-test real-Postgres databases (testcontainers or
  TC_TEST_DATABASE_URL), embedded migrations

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-domain/src/access.rs

@@ -0,0 +1,37 @@
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{AgentId, UserId};
+
+/// Which humans may use an agent (spec §7.7 "Other people" toggle).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "mode", content = "ids", rename_all = "snake_case")]
+pub enum HumanScope {
+    EntireTeam,
+    Specific(Vec<UserId>),
+}
+
+/// Which other agents may message an agent (spec §7.7 "Other Claws" toggle).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "mode", content = "ids", rename_all = "snake_case")]
+pub enum AgentScope {
+    Any,
+    Specific(Vec<AgentId>),
+}
+
+/// Per-agent access policy (spec §14 AccessPolicy).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AccessPolicy {
+    pub humans: HumanScope,
+    pub agents: AgentScope,
+}
+
+impl Default for AccessPolicy {
+    /// New agents are shared with the whole team and reachable by any claw,
+    /// matching the wizard's defaults (spec §9 step 2).
+    fn default() -> Self {
+        AccessPolicy {
+            humans: HumanScope::EntireTeam,
+            agents: AgentScope::Any,
+        }
+    }
+}