feat(release): recursion guard for the health gate; run-task drift warning; M20 packages/* decision recorded (#39)

- release.sh health gate runs with MOSAIC_ENSURE_SKIP=1: the gated task run
  cannot re-enter release self-determination
- run-task.sh warns on release drift instead of silently using a stale image
- ROADMAP: M20 decision recorded (packages/* monorepo at usurpation,
  continuity-first); restructure sequenced as M20 phase 1

Closes #39

skills/ms-tools/SKILL.md

@@ -1,14 +1,42 @@
 ---
 name: ms-tools
-description: Contains a reference to all available tools for Mosaic Stack.
-disable-model-invocation: true
+description: Reference for all available tools in Mosaic Stack.
+disable-model-invocation: false
 ---
 
 # ms-tools
 
-You are a Mosaic fleet agent. A maintained toolkit lives at `<dir>`.
-Use it FIRST for the tasks below — improvising with raw CLIs causes the recurring failures this
-skill exists to prevent. This is the high-frequency fast path; the full reference is the
-`# Machine Tools` section already in your system prompt.
+You are a Mosaic seat agent. The maintained tooling lives in the repository
+`scripts/` directory (conductor side) and `/opt/mosaic` (your container).
+Use it FIRST for the tasks below. Improvising with raw commands causes the
+recurring failures this skill exists to prevent.
 
+## Lifecycle
 
+- scripts/bootstrap.sh creates the system config. Idempotent, never overwrites.
+- scripts/build.sh builds the release image. Tag comes from RELEASE.
+- scripts/verify.sh runs the gated startup check. Exit 0 means MOSAIC_HELLO_OK.
+- scripts/release.sh ensure aligns what is installed with RELEASE. No manual
+  release commands; drift is detected and corrected at launch.
+
+## Tasks and runs
+
+- scripts/run-task.sh run <task.json> executes a governed task. Every run
+  leaves a write-once record under <dataRoot>/runs/.
+- node scripts/mosaic-task.mjs list shows run history.
+- node scripts/mosaic-task.mjs show <runId> inspects one run: receipts,
+  snapshots, stderr.
+- node scripts/mosaic-task.mjs retry <runId> re-executes a recorded task as
+  a new run. The old record stays.
+
+## Seats
+
+- scripts/agent.sh <name> launches an interactive seat. It onboards the user
+  if needed, then opens the TUI with contracts, identity, and user context.
+- agents/<name>/ holds a seat definition: agent.json plus SOUL.md.
+
+## Rules
+
+- Exit codes: 0 ok, 1 failed, 2 invalid input, 3 config missing, 4 usage.
+- A refusal is evidence. Diagnose it; do not route around it.
+- Full reference: docs/TOOLS.md.