slice 3.5d: agent_template_link + brain seed helper + skills merge

Ships the lineage layer that ties agents back to their team template
and wires the MCP skills server to actually merge template default
skills with per-agent overrides.

Migration 0050 adds `agent_template_link` (agent_id PK, template_id,
template_version, role_slot, seeded_at, created_at + indexes for
template/role lookups). Populated at agent-materialization time by
Slice 4's mission-launch orchestrator; read here by the skills MCP
server and by future level-up (Slice 8.5).

New Rust surface:
  - cm_db::repo::agent_template_link  (upsert / get / mark_seeded /
    agents_for_template — the last is what level-up's "prompt upgrade
    on template N+1" query needs)
  - cm_api::brain_seed::ingest(claw_id, seed_md, identity_prompt)
    opens cm_brain::ClawBrain on spawn_blocking, sets system_prompt
    on first touch, writes seed as agent_md, commits. Idempotent —
    skips when agent_md already populated.
  - cm_api::mcp_skills::mcp_skills tools/call now resolves the caller
    agent's template + role via agent_template_link and merges
    template default skills with per-agent overrides (was overrides-
    only in Slice 3.5b).
  - cm_api::team_template_loader now binds template_role_skills after
    upserting each template — looks up each declared skill by name,
    attaches with pin_in_context=true for foundation skills and the
    first two role skills. Missing skills log + skip.
  - Boot ordering: skills load BEFORE team templates so the binding
    lookup resolves.

Follow-up (Slice 4): mission-launch orchestrator calls brain_seed::ingest
+ agent_template_link::upsert when minting a team from a template.
Until that lands, the link is populated only by manual writes; the
MCP merge is silent-no-op for agents without a link (falls through
to overrides-only), which matches the pre-3.5d behavior.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

crates/cm-api/src/mcp_skills.rs

@@ -260,14 +260,23 @@ pub async fn mcp_skills(
                     );
                 }
             };
-            // template + role for this agent — Slice 3.5d wires
-            // agent_template_link; until then we can't merge template
-            // defaults and only surface agent_skills_ext overrides.
+            // Resolve template + role via agent_template_link so we
+            // can merge template default skills with per-agent
+            // overrides. Missing link (agent wasn't materialized from
+            // a template) → overrides-only, which is fine.
+            let link = cm_db::repo::agent_template_link::get(&state.pool, agent_id)
+                .await
+                .ok()
+                .flatten();
+            let (tpl_id, slot) = link
+                .as_ref()
+                .map(|l| (Some(l.template_id), Some(l.role_slot.as_str())))
+                .unwrap_or((None, None));
             let bindings = match cm_db::repo::skills_catalog::effective_for_agent(
                 &state.pool,
                 agent_id,
-                None,
-                None,
+                tpl_id,
+                slot,
             )
             .await
             {