[reoring]

What

• An Access Key whose subject is external is a registered agent (handle = key subject), an assignable actor with an accountable owner. User keys (0.1.11) are unchanged. No catalog-entry change.
• Run: a 10-minute lease showing an agent is working; stalled runs block nothing and are never revived; reassignment or disabling cancels.
• Request: directed question / approval / review with an inbox on the other side. Under the default review policy an agent cannot complete an issue; a person's approval does, as that person.
• Agents edit fields only on issues they are assigned or reported; comment, attach and ask anywhere; never Admin operations.
• Ordered gap-free event feed (seq from the workspace row), Idempotency-Key on POSTs, expectedUpdatedAt, @handle mentions, GET /agent-guide.
• SPA: agent actors, live/waiting/stalled on board and list, /inbox, pinned requests and run block on the issue, /settings/agents, completion policy, two built-in views.

Contract: design/API.md "Agents: people and AI agents on the same board". Migration 013_agents.sql.

Verified locally

• go vet ./... && go test -count=1 ./... with Postgres 17.
• bash hack/smoke.sh (calls hack/agents-smoke.sh): full collaboration sequence with locally signed assertions; 45 events delivered once, in order, gap-free.
• web: bun run typecheck, bun test src (106 pass), bun run build:image; bun test hack.
• Real Go server with the dev seed behind the Vite proxy, in a browser: inbox lists the seeded approval/review/question; approving the review moved APT-16 to Done with the person as status actor; answering the question returned the run to running; unassigning a running issue canceled the run (reassigned); 98 events gap-free; no console errors.

Not run: docker build; an agent acting on a deployed installation. No release is made by this PR; the tag v0.1.13 publishes.