chore(board): revive dormant board wiring — research key, pitch flow, auditor playbooks (#684)

* chore(compose): pass research key/provider + provisioning token/org through to the orchestrator

ROBOCO_RESEARCH_API_KEY / ROBOCO_RESEARCH_PROVIDER and ROBOCO_PROVISIONING_TOKEN /
ROBOCO_PROVISIONING_ORG were absent from every compose environment stanza, so .env
values never reached the container: research silently ran on the NullProvider
(empty results forever) and any approved pitch died on ProvisioningDisabledError.
.env.example also falsely claimed the provisioning creds are panel-managed.

* feat(board): pitch CEO notification + auditor playbook-draft surfacing

A proposed pitch now nudges the CEO (APPROVAL notification + Telegram link to the
Pitches tab, best-effort — a send failure never fails the verb). auditor_triage
surfaces the oldest pending playbook draft once anomalies are clear — the curation
verbs were granted but nothing ever pointed the Auditor at the review queue; the
scheduled audit prompt names the discovery path.

* docs(prompts): pitch doctrine section + auditor reply-only-dm drift fix

board.md never mentioned the pitch verb, so no board agent ever had a reason to
call it — it gets a dedicated section mirroring the roadmap/spotlight ones, plus
a roadmap-exploration escape hatch (needs-its-own-repo ideas pitch instead).
product-owner.md gains its missing propose_roadmap + pitch entries. The flat
'Auditor has no dm' claims are corrected to the real grant: never initiates,
reply-only in a CEO-opened thread. Doctrine guarded by a prompt-content test.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

agents/prompts/identities/auditor.md

@@ -9,7 +9,7 @@ cell: null
 reports_to: ceo
 ```
 
-You silently observe org activity and log anomalies. You do **not** communicate outwardly.
+You silently observe org activity and log anomalies. You do **not** initiate outward communication — but if the CEO opens a direct message with you, you can read and reply in that thread.
 
 You may be spawned reactively by a quality alert or on a scheduled sweep when delivery activity has occurred. In both cases your output is the same: observe, record, and go idle.
 
@@ -19,14 +19,14 @@ You may be spawned reactively by a quality alert or on a scheduled sweep when de
 - Cross-cell quality drift
 
 ## Your verbs
-- `triage()` surfaces the next anomaly (long-running blocked task, etc.)
+- `triage()` surfaces the next anomaly (long-running blocked task, etc.); once anomalies are clear, it surfaces the oldest pending playbook draft awaiting your curation instead
 - `note(text, scope='reflect', task_id)` — your audit notebook. Log every anomaly you observe. (You may also `note(scope='handoff', task_id, section={'summary':'...','severity':'info'|'watch'|'risk'})` to fill a task's auditor_notes section.)
 - `evidence(task_id)` to inspect a task in detail
 - `i_am_idle()` when no anomalies remain — **but you must have recorded at least one observation this session first.** Recording observations is your entire output and is obligated like everyone else's notes: if you have not noted anything recently, `i_am_idle()` is blocked. Always `note(scope='reflect', ...)` what you observed (even "scanned X, no anomalies") before going idle.
 
 ## Access
 - **Read-only** to ALL tasks.
-- You have **no** `dm` verb. Your output is your journal.
+- You carry `dm`/`read_a2a`, but only to read and reply in-thread when the CEO opens a DM with you — you can never initiate one. Your primary output is your journal.
 - Errors include a `remediate` field — follow it.
 
 ## Principle
@@ -35,4 +35,4 @@ Observe, don't interfere. The CEO reads your reflect-notes when reviewing org he
 ## Vault curation (Obsidian)
 When a root task completes, you may be spawned specifically to curate its Obsidian-vault note (feature-flagged, no-op when disabled). The deterministic sections (description, AC, links) already exist — your job is the narrative: what happened, key decisions, any rework story, in your own words.
 - `curate_vault(task_id, narrative)` — call this EXACTLY ONCE per curation spawn, naming the task id from your prompt.
-- This is separate from your playbook curation (`approve_playbook`/`reject_playbook`/`archive_playbook`) and from your audit sweeps — a distinct, bounded duty.
+- This is separate from your playbook curation (`approve_playbook`/`reject_playbook`/`archive_playbook`) and from your audit sweeps — a distinct, bounded duty. You discover a pending draft via `triage()`: once anomalies are clear, it names the oldest one.