feat(fleet): brain-home split — fleet state under ~/.mosaic, templates stay config-home

Three-tree model per canon STRUCTURE-CANON §2 (first carried by the USC
estate brain): seat launch envs, roles.local overrides, and profile
working copies are user-owned fleet state and resolve from the brain home
(~/.mosaic) when one is active; roster.yaml, baseline roles, run/, and
services stay under the config home (~/.config/mosaic).

Resolution (packages/mosaic/src/fleet/brain-home.ts, mirrored in
tools/fleet/start-agent-session.sh):
1. MOSAIC_BRAIN_HOME env — explicit, always wins
2. canonical ~/.mosaic — adopted only when MOSAIC_HOME is the default
   ~/.config/mosaic AND ~/.mosaic/fleet/agents exists (custom
   --mosaic-home never adopts: tests/sandboxes stay hermetic)
3. else legacy single-tree behavior

Call sites wired: resolveFleetPaths, fleet regen, fleet-agent-crud,
fleet-migration, personas overrideDir, profiles dir, reconciler
projections, generated-env boundary (validate + ensure + reject split
state across trees).

Tests: brain-home.spec (8), generated-env-boundary brain case, bash
launcher brain + no-brain control cases; full fleet surface 733 green.
Pre-existing unrelated failure noted: uninstall.spec 'missing mosaicHome'
throws EACCES on this host with and without this change.

packages/mosaic/framework/fleet/README.md

@@ -12,6 +12,33 @@ The default tmux socket is `mosaic-fleet` so fleet commands do not touch the
 default tmux server. The roster is the desired-state authority; generated environment files are
 rebuildable projections, never a second source of configuration.
 
+## Brain-home split (fleet state vs framework templates)
+
+When a mosaic-brain clone is present, fleet **state** resolves from the brain
+home while framework templates and dispatch state stay in the config home
+(three-tree model, canon `docs/STRUCTURE-CANON.md` §2):
+
+| Path                                                                            | Without brain (legacy)                | With brain                     |
+| ------------------------------------------------------------------------------- | ------------------------------------- | ------------------------------ |
+| `fleet/agents/<seat>.env.*`                                                     | `~/.config/mosaic/fleet/agents/`      | `~/.mosaic/fleet/agents/`      |
+| `fleet/roles.local/` (overrides)                                                | `~/.config/mosaic/fleet/roles.local/` | `~/.mosaic/fleet/roles.local/` |
+| `fleet/profiles/` (working copies)                                              | `~/.config/mosaic/fleet/profiles/`    | `~/.mosaic/fleet/profiles/`    |
+| `fleet/roster.yaml`, `fleet/roles/` (baseline), `fleet/run/`, `fleet/services/` | `~/.config/mosaic/fleet/…`            | unchanged (config home)        |
+
+Activation (`packages/mosaic/src/fleet/brain-home.ts`, mirrored in
+`tools/fleet/start-agent-session.sh`):
+
+1. `MOSAIC_BRAIN_HOME` env var — explicit, always wins.
+2. Canonical `~/.mosaic` — adopted only when `MOSAIC_HOME` is the default
+   `~/.config/mosaic` AND `~/.mosaic/fleet/agents` exists. Custom
+   `--mosaic-home` values (tests, sandboxes, canaries) never adopt, keeping
+   them hermetic.
+3. Otherwise the config home (legacy single-tree behavior).
+
+Seat env dirs under a brain are subject to the same privacy boundary (0700
+dirs, 0600 files); `.env.generated` files are structure-valuable and tracked
+in the brain repo, hand-maintained `.env`/`.env.local` stay ignored and private.
+
 ## Examples
 
 - `examples/minimal.yaml` starts one local canary slot.