feat(agent): wire AGENTS.md discovery into a policy-gated turn

[rrrodzilla]

Closes #29.

What this does

Wires the runtime's AGENTS.md discovery (Govcraft/acton-ai#15, shipped in acton-ai 0.36.0) into the daemon, gated by a governed install's policy bundle, per the issue's requirements: AGENTS.md only (no GARRISON.md), project instructions treated as untrusted content that can never widen what the bundle/approved root/sandbox/approval gate decide, and a policy-bundle knob to disable or restrict discovery.

Design

• Confined. Discovery always calls acton-ai's discover_with_root(working_directory, project_root, user_file), never its convenience discover() (which walks up to the nearest .git — a different, possibly wider, root than every other gate in this daemon already enforces).
• Gated. New PolicyBundle fields: agents_md_discovery (enabled / disabled / restricted, default enabled — preserves current behavior for untouched bundles) and agents_md_allowed_paths (newline-separated, meaningful only under restricted). Both are part of the checksum (allowed_paths sorted before hashing). A governed bundle's setting is exclusive, same as command/tool rules; standalone runs unrestricted (same trust the local auto-approve list gets); an Ungoverned install or a failed policy ask fails closed to disabled.
• Labeled. The injected fragment tells the model, in its own context, that what follows is project content, not an operator instruction — defense in depth, not the boundary itself (the real boundary is structural: sandbox/approval/rules never read a turn's context).

The audit-trail gap

The issue asks that loading an AGENTS.md be recorded in the audit trail (which files, which hash) so an auditor can see what steered a turn. Building this surfaced that acton-ai's TurnRecord has no field for it, and sealing is entirely internal to the crate — garrison-agent has no way to inject this into the tamper-evident chain today.

Filed Govcraft/acton-ai#18 proposing a chain-integrated field (mirroring how acton-ai#16 unblocked turn entries). Until that lands, loaded files + BLAKE3 hashes (never content) are recorded via structured tracing — documented in both design docs as logged, not sealed, so this isn't quietly overclaiming a guarantee it doesn't have yet.

Also fixed along the way

• header_of()'s agents_md_discovery parsing can't reuse the hook's generic parse_enum(): that helper collapses "field absent" and "unrecognized value" onto the same Default, which is safe for NetworkEgress/ApprovalMode (their default is the strict end) but wrong here, since this field's schema default (Enabled, for backward compat) is the permissive extreme. A dedicated parse_agents_md_discovery() keeps "absent → Enabled" but fails an unrecognized value closed to Disabled.
• PromptBuilder::system() replaces rather than appends (verified against acton-ai's source) — caught before shipping a bug where the operator's configured system prompt and the AGENTS.md fragment would have silently clobbered each other.
• Regenerating the hook protos picked up an unrelated, correct fix already latent in schemas/audit.schema: AuditEvent.operator was never required (filled in by the ingest hook, never sent by the daemon), so audit_event_hooks.proto's operator field is now optional string to match — it had drifted to non-optional.

Verification

• cargo check --workspace --all-targets — clean
• cargo clippy --locked --workspace --all-targets -- -D warnings — zero warnings
• cargo test -p garrison-policy --lib — 76/76
• cargo test -p garrison-hooks policy_bundle:: — 14/14 (includes the two new fail-closed-behavior tests)
• cargo test -p garrison-wire --lib — 38/38
• garrison-agent's own test binary aborts locally on startup due to a pre-existing, machine-local AWS-LC-FIPS self-test SIGABRT unrelated to this change (confirmed against CI on a prior PR, which ran the same suite clean) — relying on this PR's CI run to verify it, same as the last PR that touched this crate.