feat(roles): M18 seat-role progressive capability restriction (#45)

Role contracts (roles/<role>.json): roleVersion, name bound to filename,
tools ceiling (subset of pi built-ins), network declared (none|api-only|
open; enforced when network policy lands). Strict schema, fail closed -
a non-role document refuses resolution.

mosaic-task.mjs resolve-role: config-free contract validation, emits
MOSAIC_ROLE_TOOLS / MOSAIC_ROLE_NETWORK.

agent.sh: a declared role binds to its contract. Missing/invalid contract
refuses the launch (exit 2, names the role - the under-equipped-seat
failure mode, mirroring M17 skills). Effective tools = ceiling ∩ requested
(CLI --tools or agent.json caps); no request -> ceiling stands; narrowing
and tool-free outcomes loud on stderr. Adapters unchanged; headless M9
chain (mission ∩ task) untouched.

Ships roles/researcher.json (existing seat declares the role; without the
contract the fail-closed gate would refuse its launch).

Task suite 74 -> 88: contract resolution, wrong-kind/name/network/
duplicate/unsupported/missing refusals, ceiling narrowing E2E (mock
adapter), tool-free E2E, missing-contract refusal. Test-authoring
correction recorded in BUILD-LOG (a check that registered on one path
only, caught by count arithmetic).

Suites 24/88/14/17 + verify green.

docs/TOOLS.md

@@ -30,6 +30,7 @@ and changes nothing.
 | `node scripts/mosaic-task.mjs list` | List runs | task/workspace/session columns |
 | `node scripts/mosaic-task.mjs retry <runId>` | Re-execute a run's snapshot | New run dir; `retriedFrom` lineage recorded |
 | `node scripts/mosaic-task.mjs prune [--keep=N] [--yes]` | Retention | Dry-run default; receipt in `runs/.pruned.log` |
+| `node scripts/mosaic-task.mjs resolve-role <roleFile>` | Validate a role contract | Prints `MOSAIC_ROLE_TOOLS` / `MOSAIC_ROLE_NETWORK`; config-free |
 
 Task fields: `prompt` (required), `mission` (path), `expectExact`,
 `timeoutSeconds` (5–600), `workspace` (`:run` or named), `capabilities.tools`
@@ -48,6 +49,11 @@ Launches an interactive pi TUI inside the container with the four immutable
 contracts + optional mission + agent identity as its system prompt,
 persistent named session, optional workspace. Exit with `/quit`.
 
+A seat role (`agent.json` `role`) binds to `roles/<role>.json` (M18): the
+contract's tools are a ceiling the seat definition or `--tools` may narrow,
+never escalate past. Missing/invalid contract refuses the launch; empty
+intersection = loud tool-free seat.
+
 ## Release
 
 | Command | Purpose | Notes |
@@ -75,7 +81,7 @@ Push is never automatic.
 |---|---|---|
 | `scripts/reset.sh` | Delete the data root | Triple-safety-checked (path, symlink, ownership marker) |
 | `scripts/test-config.sh` | Config selftests (no Docker) | 24 cases |
-| `scripts/test-task.sh` | Task selftests + live cases | 74 cases |
+| `scripts/test-task.sh` | Task selftests + live cases | 88 cases |
 | `scripts/test-release.sh` | Release selftests | 14 cases |
 | `scripts/test-conductor.sh` | Auto-apply selftests (sandboxed) | 17 cases |
 | `scripts/gitea-api.sh <METHOD> <path> [body]` | Gitea API helper | Token never on argv/stdout |