docs(skills): owner loop-doctrine + collaborator delivery discipline, remediated (#44)

ms-communications: integrated as-authored - owner preamble restructure +
collaborator delivery-discipline hunks from the #43 calibration (own
session output is not a send path; the tool performs the preamble flip;
receiving rule 3 requires actually running agent-send.sh).

ms-conductor: collaborator redraft integrated (canon-aligned tracking
surfaces, one-action cadence, fail-closed core) with one conductor
remediation - step 3 now distinguishes refusal (fail closed, never
bypass) from runner outage (direct dispatch to a qualified live seat via
ms-communications permitted, recorded loudly as degraded: no sandbox, no
run record; suites still gate integration). Preserves the owner's
outage-dispatch intent inside invariant 6.

docs/TOOLS.md: release.sh ensure row added (M16 subcommand existed in
code but not in the doc - flagged by the collaborator, verified in
release.sh usage).

Authorship: owner (ms-conductor doctrine, preamble restructure) +
ms-test collaborator (delivery hunks, redraft); remediation + integration
by conductor (dragon-lin:darkwing). Suites 24/74/14/17 + verify green;
unslop clean.

docs/TOOLS.md

@@ -56,6 +56,7 @@ persistent named session, optional workspace. Exit with `/quit`.
 | `scripts/release.sh activate` | Health gate → atomic pointer swap | `--fault-injection` proves the refusal path |
 | `scripts/release.sh rollback` | Health-gated return to previous | Refuses if image missing |
 | `scripts/release.sh status` | Release, tag, active pointer, log | Safe on empty state |
+| `scripts/release.sh ensure` | Self-determination: align active pointer to `RELEASE` | Fast path restores a missing/mismatched pointer without a gate; slow path packages + health-gates first. Invoked automatically at launch |
 
 ## Conductor (worker patches)