Merge bux v1-v16 stack: simpler doctrine, /goal copilot-by-default, composio for codex

Lands 16 stacked PRs reviewed by multiple sub-agents:

- v1 (#209)  /goal as primitive, per-topic autopilot vs copilot
- v2 (#210)  drop agency-mode gate, fold doctrine into CLAUDE.md, delete old Mini App UI
- v3 (#211)  CLAUDE.md → system-prompt.md (source of truth), agent identity = "agency"
- v4 (#212)  trim system prompt to 87 lines, mode emoji in topic title, extract bot/markdown.py
- v5 (#213)  heartbeat-by-default plumbing (later removed), copilot voice fix, autopilot security note
- v6 (#214)  steering semantics, new-topic spawning, 2-option cards, source-aware images
- v7 (#215)  /goal IS autopilot framing, drop topic emoji prefix, silence allowed, codex goals=true, `schedule` alias
- v8 (#216)  drop --spawn-topic, --importance, trim agency-report docstring
- v9 (#217)  new-topic helper — spawn fresh lane synchronously, queue heartbeat
- v10 (#218) self-schedule only when waiting on something concrete; drop auto-heartbeats
- v11 (#219) /goal is a verbatim CLI passthrough; bot is a dumb pipe
- v12 (#220) drop 30-min timeout, kill lingering heartbeat, prompt-injection defenses, seed goals.md
- v13 (#221) /goal stays copilot by default; autopilot only on explicit user opt-in
- v14 (#222) doctrine fixes from final multi-agent review
- v15 (#223) tighten autopilot triggers — drop the loose phrases
- v16 (#224) register composio MCP for codex too; simplify autopilot trigger paragraph

Tests: 22 pass.

Follow-ups (tracked, not in this merge):
- P0: install bootstrap.sh as /usr/local/sbin root:root (closes the trivial bux→root)
- P1: stuck-lane watchdog (no-stdout-for-30-min SIGTERM)
- P1: /invite is a dead command (remove from BotFather menu)
- P1: composio tool names wrong-case in system prompt
- P1: help text + COMMANDS still reference dropped autopilot trigger phrases
- P1: BUX_BOX_TOKEN provenance for OSS self-host installs
- P2: button-tap dispatches bypass _enqueue (lane race on rapid taps)
- P2: persisted per-topic autopilot flag in state (instead of LLM phrase detection)
- P2: agency_db ghost columns (importance, spawn_topic)
- P2: mini app teardown decision (1700 LOC for an unreferenced surface)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MagMueller

.gitignore

@@ -3,6 +3,7 @@ __pycache__/
 *.log
 .env
 .DS_Store
+.claude/
 
 # `private/` is the per-box drop zone for personal context — skill files,
 # memory snapshots, scratch notes, anything you'd never want pushed to

AGENTS.md

@@ -1 +1 @@
-agent/CLAUDE.md
+agent/system-prompt.md

agent/AGENCY.md

@@ -0,0 +1 @@
+system-prompt.md

agent/AGENTS.md

@@ -0,0 +1 @@
+system-prompt.md