chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

scripts/with-local-supabase-env.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PROFILE="${1:?usage: with-local-supabase-env.sh <web|admin|mobile|mcp|tests> <command...>}"
+shift
+[ "$#" -gt 0 ] || { echo "command is required" >&2; exit 2; }
+
+STATUS_ENV="$(cd "$ROOT" && npx supabase status --workdir apps -o env 2>/dev/null)" || {
+  echo "Local Supabase is not running. Run scripts/dev-local.sh up." >&2
+  exit 1
+}
+eval "$STATUS_ENV"
+
+case "${API_URL:-}" in
+  http://127.0.0.1:*|http://localhost:*) ;;
+  *) echo "Refusing non-local Supabase URL: ${API_URL:-unset}" >&2; exit 1 ;;
+esac
+
+case "$PROFILE" in
+  web)
+    exec env NEXT_PUBLIC_SUPABASE_URL="$API_URL" "$@"
+    ;;
+  admin)
+    exec env VITE_SUPABASE_URL="$API_URL" VITE_SUPABASE_ANON_KEY="$ANON_KEY" "$@"
+    ;;
+  mobile)
+    exec env EXPO_PUBLIC_SUPABASE_URL="$API_URL" EXPO_PUBLIC_SUPABASE_ANON_KEY="$ANON_KEY" "$@"
+    ;;
+  mcp)
+    exec env PORT=3002 SUPABASE_URL="$API_URL" \
+      SUPABASE_SERVICE_ROLE_KEY="$SERVICE_ROLE_KEY" \
+      SAUCI_MCP_API_KEY="local-sauci-mcp-only" "$@"
+    ;;
+  tests)
+    exec env SUPABASE_URL="$API_URL" SUPABASE_ANON_KEY="$ANON_KEY" \
+      SUPABASE_SERVICE_ROLE_KEY="$SERVICE_ROLE_KEY" "$@"
+    ;;
+  *) echo "unknown profile: $PROFILE" >&2; exit 2 ;;
+esac