feat(agent): fail-closed seat resolution under MOSAIC_AGENTS_DIR override (#46)

Owner decision after live verification of M18: an explicit agents-dir
override that cannot resolve the named seat now refuses the launch
(exit 4, names the seat and dir) instead of launching seatless and
unbounded. Unsetting the override keeps the M13 plain governed TUI.
MOSAIC_ROLES_DIR needs no symmetric change - the M18 gate already
refuses unresolvable role contracts.

Task suite 88 -> 90 (refusal + refusal-names-the-seat). TOOLS.md Agent
section documents the refusal.

Suites 24/90/14/17 + verify green.

docs/TOOLS.md

@@ -52,7 +52,9 @@ persistent named session, optional workspace. Exit with `/quit`.
 A seat role (`agent.json` `role`) binds to `roles/<role>.json` (M18): the
 contract's tools are a ceiling the seat definition or `--tools` may narrow,
 never escalate past. Missing/invalid contract refuses the launch; empty
-intersection = loud tool-free seat.
+intersection = loud tool-free seat. An explicit `MOSAIC_AGENTS_DIR` override
+that cannot resolve the named seat also refuses (#46) — unset the override
+for the M13 plain governed TUI.
 
 ## Release
 
@@ -81,7 +83,7 @@ Push is never automatic.
 |---|---|---|
 | `scripts/reset.sh` | Delete the data root | Triple-safety-checked (path, symlink, ownership marker) |
 | `scripts/test-config.sh` | Config selftests (no Docker) | 24 cases |
-| `scripts/test-task.sh` | Task selftests + live cases | 88 cases |
+| `scripts/test-task.sh` | Task selftests + live cases | 90 cases |
 | `scripts/test-release.sh` | Release selftests | 14 cases |
 | `scripts/test-conductor.sh` | Auto-apply selftests (sandboxed) | 17 cases |
 | `scripts/gitea-api.sh <METHOD> <path> [body]` | Gitea API helper | Token never on argv/stdout |