feat(engine): the manager — chat orders, team, triage, verdicts, bootstrap

Phase 3 of the AI-workforce engine (TODO-agent-2):

- engine/manager.py: ManagerTurns.chat (CREATE_TASK/PAUSE/RESUME/CANCEL,
  HIRE/UPDATE_EMPLOYEE/FIRE, KNOWLEDGE), triage (ASSIGN/REJECT/ASK_USER),
  final_review (COMPLETE/REVISE +cycle), error_review (RESOLVE_ERROR/CANCEL),
  bootstrap_team; post_user_message now delegates to it.
- One billing path: call_model/BillingScope in runner.py is the single model
  entry point (fixes the agybot chat-billing bug).
- Team changes capped at 3/turn, employee cap, last manager cannot be fired,
  hires pick a granted model of the requested tier strictly.
- container_engine.py wires the real WorkforceBootstrapPort.
- Fixes: REVISE is a body tag (prompt and parser now agree); ASSIGN
  employee="" means pick-for-me; the runner's protocol-error retry is capped by
  engine_max_protocol_retries (was unbounded until the turn timeout).
- 20 new manager tests + regression tests; report in
  docs/plan/reports/agent-2-phase-3.md.

apps/api/app/application/engine/events.py

@@ -186,4 +186,22 @@ class RunFeed:
         return stream
 
 
-__all__ = ["RunFeed"]
+async def emit_team_changed(
+    *, organization_id: str, change: str, employee_id: str
+) -> None:
+    """The team changed (hired, fired, re-tiered): the workforce page reloads."""
+    await publish(
+        RealtimeEvent(
+            type="team.changed",
+            channels=(org_channel(organization_id),),
+            organization_id=organization_id,
+            data={
+                "change": change,
+                "employee_id": employee_id,
+                "organization_id": organization_id,
+            },
+        )
+    )
+
+
+__all__ = ["RunFeed", "emit_team_changed"]