Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary
(claws, /claws routes, clawId, Claw Chat) stays — it is now the brand.

- Display brand: Clawmates (manifest, titles, hero, login/rail logo
  'clawmates'); default host app.clawmates.work; registry
  ghcr.io/clawmates
- Crates tc-* -> cm-* (16 crates + all imports); binaries
  clawmates-server/broker/bundler; images clawmates/*; env prefix
  CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config
  clawmates.toml; helm chart deploy/helm/clawmates with clawmates-*
  resources; db names clawmates*; sockets /run/clawmates; cookie
  cm_session; kind cluster clawmates-test; seccomp node profile
  clawmates-agent-profile.json
- All 9 Playwright brand assertions updated in lockstep; historical
  spec document left untouched as the only remaining 'TeamClaw'
- Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared
  test server clawmates-test-pg, kind cluster recreated with image +
  profile, compose images rebuilt under clawmates/*

Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright
journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and
the clean-room install rehearsal serving the clawmates login page from
a signed bundle of the rebuilt images.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/cm-domain/src/access.rs

@@ -0,0 +1,37 @@
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{AgentId, UserId};
+
+/// Which humans may use an agent (spec §7.7 "Other people" toggle).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "mode", content = "ids", rename_all = "snake_case")]
+pub enum HumanScope {
+    EntireTeam,
+    Specific(Vec<UserId>),
+}
+
+/// Which other agents may message an agent (spec §7.7 "Other Claws" toggle).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "mode", content = "ids", rename_all = "snake_case")]
+pub enum AgentScope {
+    Any,
+    Specific(Vec<AgentId>),
+}
+
+/// Per-agent access policy (spec §14 AccessPolicy).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AccessPolicy {
+    pub humans: HumanScope,
+    pub agents: AgentScope,
+}
+
+impl Default for AccessPolicy {
+    /// New agents are shared with the whole team and reachable by any claw,
+    /// matching the wizard's defaults (spec §9 step 2).
+    fn default() -> Self {
+        AccessPolicy {
+            humans: HumanScope::EntireTeam,
+            agents: AgentScope::Any,
+        }
+    }
+}