[vikasprogrammer]

Closes #903, closes #904.

What changed

• policyContext = os.policy.id on every creation path: console/agent_create create, the runtime-aware create, manifest import, catalog install (installAgentFromCatalog rewrites the copied agent.json), the seeded agent-author, and the System agents (concierge/operator, strategist, diagnosis, skill-scout, consolidator, improver). Non-default tenants no longer get a false policyContextMismatch warning per new agent.
• Writers merge onto disk. New onDiskManifest(ag) in src/state/agent-edit.ts reads agent.json (same as a rescan/restart would load) and falls back to memory if missing/unparseable/id-mismatched. It's now the base in applyAgentEdit (self-edit + cross-agent apply), applyAgentSnapshot (revert), the console PUT /api/agents/:id/config, and duplicate. Hand edits like an added shellSecrets or corrected policyContext survive the next edit.
• agent_create takes shellSecrets, passed through to the route's existing sanitiser. It declares intent only; injection is still gated by the vault grant.

Not changed

• Agents already on disk with default@v3 on a non-default tenant keep it. Fixing those is still a job for policy-reconcile.
• init.ts scaffolding and the mock demo keep their labels, because they run before or without a tenant policy.

Validation

• npm run typecheck, npm run build, npm run test:governance all green.
• New scripts/agent-manifest-disk-test.cjs (19 checks, added to the gate) boots a tenant enforcing acme@v2 and covers: creation stamps the ruleset with no drift warning; shellSecrets is accepted at creation; out-of-band edits survive the self-edit, the config PUT and a revert; the seeded agent-author is stamped.

🤖 Generated with Claude Code