Production-readiness review and hardening

The system is the enquiries agent from the earlier courses split along the lethal trifecta. The reader sees untrusted documents and private data but has no way to communicate: its headless run has two tools, Read and Glob, and a hook that denies everything else. The sender can communicate but never sees untrusted text: it has no model, sends only a draft a person approved, and takes the recipient from data/matters.json. The decision that matters most is that split. Every other control (checks, hook, audit, budget, gate) is a second layer or the evidence that the first one held.