Add evals for every shipped agent, a policy corpus, and CI

§9 says no agent ships without evals. Eight of the nine had none: the two
other suites in evals/ are harness fixtures rather than agents in the
registry, so the rule was being met by one agent in nine.

Evals — 40 new cases, five per agent, every one carrying mustNotLeak:

  - the agent is loaded from its real spec in agents/*.md rather than
    written out again in Go. A hand-copied agent tests the copy: it keeps
    passing after somebody edits the spec, which is the moment it most
    needed to fail.
  - callNamed calls the tool a case names. toolThenAnswer always called
    tools[0], so seven of positions-agent's eight tools were unreachable,
    and a boundary nothing calls is a boundary nothing tests.
  - seedWorkspace fills BOTH tenants. A leak test against an empty second
    tenant cannot fail.

Verified by breaking workersByScore's org predicate: six cases across four
agents fail with LEAKED "RIVAL".

Knowledge — six policy documents, taking the corpus from 2 to 8 (34
chunks). Three restricted to admin and employer, five tenant-wide. They
cover what the tools cannot: a tool reports how many shifts went unworked,
a policy says what cover costs inside 24 hours.

corpus_test.go treats those documents as product rather than fixtures. The
first version was tautological — it read audience: from a file and checked
that file's audience was enforced, so opening a restricted document passed.
mustNotBeTenantWide now holds that judgement apart from the files, with the
reason recorded for each.

CI — the checks this repository already had, made unskippable. testutil
calls t.Skipf on an unreachable database, so a dead service container would
produce a green build over a suite that ran almost nothing. Simulated: go
test exits 0 with 74 tests skipped, including every tenant-isolation test.
The guard exits 1 and names them, while still allowing TestLive* to skip
without a model key.

This CI tests; it does not deploy. The README's claim that migrations are
run by CI against the target database remains aspirational.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186JgqQUCDS8ZwGmyw3ymWu

knowledge/incidents-and-escalation.md

@@ -0,0 +1,50 @@
+---
+source: policy_docs
+audience: tenant
+title: Incidents and Escalation
+---
+
+# What to report
+
+Report anything that injured somebody, could have injured somebody, or would
+embarrass the venue if it appeared in a review. The third category is the one
+people skip, and it is where most patterns start.
+
+A near miss is reportable. A glass broken behind the bar with nobody hurt is a
+near miss if it happened because the floor was wet, and is not if it was simply
+dropped.
+
+# How to report
+
+Tell the supervisor on duty at the time. They record it before the end of the
+shift — a report written the next day loses the detail that made it useful, and
+the people who saw it have gone home.
+
+An incident involving injury, the police, or a safeguarding concern also goes to
+the venue manager the same day, whatever the hour.
+
+# Escalation
+
+| Situation | Who decides | By when |
+|---|---|---|
+| Guest refused service, escalating | Supervisor on duty | Immediately |
+| Physical altercation | Venue manager, and police if ongoing | Immediately |
+| Injury needing more than first aid | Venue manager | Same day |
+| Safeguarding concern about a young person | Venue manager, then designated lead | Same day |
+| Allegation against a member of staff | Venue manager, do not investigate on the floor | Same day |
+
+# Safeguarding
+
+Anyone under 18 working an event is not left alone with guests and does not
+serve alcohol. Where an event is for under-18s, at least one supervisor holds a
+current safeguarding certificate.
+
+A concern about a young person — staff or guest — is passed on the same day.
+Passing it on is the whole obligation; deciding whether it is serious enough is
+not the reporter's job and never has been.
+
+# After an incident
+
+The worker involved is offered a conversation the following working day. This is
+not an investigation and is not recorded against them. A worker who has had a
+bad night and hears nothing usually concludes the venue did not notice.