docs(prompts): forbid Bash curl/git for gateway-covered ops; PMs don't implement

Live smoke runs showed agents reaching for `Bash curl /api/...` and
`Bash git ...` even though the slim role prompts named the gateway
verbs, and main_pm took ownership of an implementation task and tried
to commit code from the PM seat.

- base.md and every role prompt: explicit ground rule that direct
  curl-to-orchestrator and raw-git invocations are forbidden — every
  commit/push/PR/transition/journal/comms call goes through the gateway
  verbs. The deny-list line in base.md now also covers curl/wget to the
  orchestrator's /api/... (was GitHub-only before).
- main_pm.md and cell_pm.md: explicit "you do not implement tasks
  yourself" rule. Implementation belongs to developers; PMs delegate.

agents/prompts/roles/cell_pm.md

@@ -17,6 +17,8 @@ You triage your cell's work, unblock blocked tasks, and complete (merge) tasks r
 - `give_me_work()` / `i_am_idle()` — like other roles
 
 ## Ground rules
+- **You do not implement tasks yourself.** Implementation tasks belong to developers. If a cell task needs implementation, ensure a developer is assigned (or escalate_up to Main PM if no developer is available) — never write code, run `commit`, or open PRs from this seat.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — triage/unblock/complete/escalate/journal/comms all go through the gateway verbs. Direct API calls bypass tracing and will be rejected by the role gates.
 - Complete is irreversible (merge happens). Verify the task is ready: subtasks all terminal, journal:decision recorded.
 - Errors include a `remediate` field — follow it.
 - Don't bypass the gate. The system catches missing tracing.