feat(demo): hr agent ui and definition

[guillaume-hexamind]

Adds an HR (RH) agent as a fourth HexGate-gated showcase, alongside healthcare, devops, and itsm. It demonstrates role-based field-level scoping over an employee record plus identity-bound self-service.

Agent

• hr_agent.py — LangChain create_react_agent. HR-staff tools (search_directory, get_employee_data field-scoped per role, get_medical_leave, update_salary, view_compensation, export_payroll with a per-role count cap, offboard_employee) plus self-service tools keyed off the caller's identity (get_my_leave_balance, request_time_off, list_my_time_off) so an employee only ever acts on themselves. Roles: default < manager < gestionnaire_rh.
• hr.py — contract wrapper (plain vs HexGate-gated path).
• hr_state.py — minimal in-memory time-off store (balances + requests).
• ui/hr.yaml — chat + tool-calls panel.

Shared / refactor

• langchain_events.py — extracted the to_native_event projection + messages_input shared by the ITSM and HR LangChain agents (ITSM now imports them; no duplication).
• Role fallback normalization: the HR wrapper collapses any role that isn't manager/gestionnaire_rh to default; the DevOps wrapper likewise collapses anything but operator/admin to default (devops viewer role renamed to default).

Wiring & demo

• Roster (+hr), select.py, pyproject.toml (langgraph added to the shared LangChain extra), Makefile register.
• HR demo users + per-user agents allow-lists in demo-users.yaml; QUICKSTART.md.

Note: the matching policies live on the platform — paste/update hr_policy.yaml and devops_policy.yaml from hexgate/examples/ and re-run make register.