Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/piggy/src/chat-tools.ts

@@ -11,31 +11,32 @@ import {
   supplyDeals,
   type Database,
 } from '@pig/db';
+import { isPageContext } from '@pig/core';
 import { eq } from 'drizzle-orm';
 import { z } from 'zod';
 import type { PiggyChatContext } from './chat';
+import { createPagePigTools } from './page-tools';
 import { defineTool, type AgentTool } from './provider';
 import { createAccountLifecycleTool } from './lifecycle-tools';
 
 const noInput = z.object({}).strict();
 
-/** Interactive chat gets one record-scoped read tool and no ambient access. */
+/**
+ * Interactive chat gets one scoped read tool and no ambient access.
+ *
+ * A record context gets `pig_get_record`, which takes no id and so cannot
+ * pivot to another row. A page context gets the single tool that answers that
+ * page — and never `pig_get_record`, because there is no record to read and a
+ * tool that would throw is a wasted turn out of four.
+ */
 export function createInteractivePigTools(
   db: Database,
   context: PiggyChatContext | undefined,
 ): AgentTool[] {
-  if (!context) {
-    return [
-      defineTool({
-        name: 'pig_get_workspace_summary',
-        description:
-          'Read a bounded summary of the PIG workspace: active deals, commitments, allocations ' +
-          'and contracts. This cannot inspect the filesystem or external systems.',
-        inputSchema: noInput,
-        execute: async () => readWorkspaceSummary(db),
-      }),
-    ];
-  }
+  // No context is the dashboard case by another name: the same bounded
+  // workspace overview, rather than a second definition that could drift.
+  if (!context) return createPagePigTools(db, '/');
+  if (isPageContext(context)) return createPagePigTools(db, context.route);
   if (context.type === 'account') {
     return [
       defineTool({
@@ -61,31 +62,9 @@ export function createInteractivePigTools(
   ];
 }
 
-async function readWorkspaceSummary(db: Database): Promise<unknown> {
-  const [demand, supply, commitments, reservations, paperwork] = await Promise.all([
-    db.select().from(demandDeals).limit(100),
-    db.select().from(supplyDeals).limit(100),
-    db.select().from(capacityCommitments).limit(100),
-    db.select().from(allocations).limit(200),
-    db.select().from(contracts).limit(100),
-  ]);
-  return {
-    demandDeals: demand,
-    supplyDeals: supply,
-    capacityCommitments: commitments,
-    allocations: reservations,
-    contracts: paperwork,
-    truncated: {
-      demandDeals: demand.length === 100,
-      supplyDeals: supply.length === 100,
-      capacityCommitments: commitments.length === 100,
-      allocations: reservations.length === 200,
-      contracts: paperwork.length === 100,
-    },
-  };
-}
+type PiggyRecordContext = Exclude<PiggyChatContext, { type: 'page' }>;
 
-async function readFocusedRecord(db: Database, context: PiggyChatContext): Promise<unknown> {
+async function readFocusedRecord(db: Database, context: PiggyRecordContext): Promise<unknown> {
   if (context.type === 'account') {
     const [account] = await db.select().from(accounts).where(eq(accounts.id, context.id)).limit(1);
     if (!account) throw new Error('The account in focus no longer exists.');