feat: per-role model defaults + surveyor arsenal

[nrdxp]

Summary

Restores (properly, on master) the model: frontmatter the installer never emitted — the field that lets the harness launch each agent at its expected tier without the composer specifying it per dispatch — plus the surveyor's arsenal discipline.

Defaults

Role class	Model	Rationale
Council seats (*-seat)	opus	architect-tier judgment must survive a cheaper composer
Workers & reviewers	sonnet	the routine disciplined-walk tier
survey-worker	haiku	quick and bounded — predicated on the composer supplying well-defined boundaries, which its conditioning now requires

A campaign IBC may elevate a specific dispatch; these are ambient defaults, deliberately encoding the routine posture.

Arsenal discipline (companion conditioning)

• Surveyor: runs the outward-environment step before its first search — semantic code search (e.g. grepai) where installed beats grep for intent-shaped questions; falls back to self-enumeration when the dispatch doesn't name tools. "A survey run on grep alone in a project with semantic search is hole-digging in capability space."
• Composer: names the project's search arsenal in every survey dispatch — the surveyor checks regardless, but the composer holds the project context.

Verification

Conditioning suite all-pass; installer re-run against the live harness confirms model: opus on seats, model: haiku on the surveyor, model: sonnet elsewhere.

[nrdxp]

Added per nrd: explicit CLI-merge semantics. The forge skill's §4 previously permitted CLI merges while listing gh pr merge first — now the default is unambiguous: merge in git, push, the forge observes (fast-forward/octopus/merge-commit as the history calls for; the merge API constrains strategy and manufactures commits outside the commit gate — never the default). New prime directive MERGE_IN_GIT; the composer — who performs most campaign merges post-consent — carries the same rule in its conditioning. Suite: all pass. Note: this touches the composer persona, so a reinstall after merging this PR picks it up.

[nrdxp]

Correction on the record: commit a9a59a4 truncated skills/forge/SKILL.md to zero bytes — a tuple-assignment bug in the patch script caused open-for-write truncation before the write failed, and the commit gate's link audit passed the empty file (no links, no invalid links). Fixed prospectively in the follow-up commit: file restored, the intended merge-semantics edits landed with content assertions run before committing this time.

Two durable takeaways worth predicate's process-feedback ledger: (1) the link auditor passes empty files — a non-emptiness check on audited docs would have blocked a9a59a4 at the gate; (2) patch-script writes should assert the post-state, not just the anchors. Both are gate-hardening candidates.

The substance stands as described in the previous comment: MERGE_IN_GIT directive, forge §4 rewritten (git CLI is the instrument, the forge observes; API never the default), composer conditioned likewise. Suite: all pass.