epic(integration): Phase 01 real full-stack wave — Auth, Skills, AgentRun, Chat

## Goal

Replace mock-only product paths with a verified browser → API → application → repository → PostgreSQL/Redis flow, starting with Auth, Skills/Agent catalogs, AgentRun foundations, and Chat.

## Verified baseline

- origin/main b2045b92
- ./init.sh fails only at @repo/api#test because PostgreSQL connections terminate under the full suite: 32 files / 87 tests failed; tracked by #74.
- Login has a partial live path but the Web/API error envelope disagrees.
- Chat has live management/read capabilities but the signed UI is mock and message send/agent execution are absent.
- Skills and AgentRun have broad contracts/domain rules but no dedicated runtime persistence/controllers.
- No verify:full exists; #387 tracks the missing real full-stack gate.

## Execution waves

### Wave 0 — restore trustworthy baseline
- Reuse #74: isolate each run/worktree DB and make ./init.sh reproducible.
- Reuse #403 for the separate coord-gateway workerd CI isolation failure.

### Wave 1 — integrate only already-signed behavior
1. Shared Web API error envelope + real Session/Identity/current-org provider.
2. Formal Chat UI reads real thread list/detail/messages/agent roster.
3. Skills and Agents library screens read the real capability catalog; empty org remains a true empty state.
4. Explicit organization-admin starter-pack import; no hidden runtime defaults.
5. Reuse #387 to add a real browser/API/DB smoke for login → identity → chat/catalog reads.

### Wave 2 — contract/signoff required
- Email verification public completion path and real email transport.
- Chat message write/list pagination if current contract gaps require additions.
- Dedicated Skill repository/version/mount lifecycle.
- Minimal no-tool AgentRun executor and model provider.
- Agent output persistence to Chat; then SSE, MCP and approval/recovery.

## Non-negotiable gates

- One issue / branch / PR.
- No silent mock fallback on product routes.
- No automatic built-in Agent/Skill seed; starter pack is an explicit organization import with provenance.
- Feature passing is not phase runtime readiness; browser + API + DB effects are the release evidence.
- New API semantics wait for bundle-level design signoff; regression wiring of existing contracts may proceed.

## Existing dependencies

#74, #372, #387, #397, #403.

Start by running ./init.sh and reviewing blockers #74, #387, #372, #397, and #403 to establish the baseline and dependency boundaries. The issue is done only when one scoped wave has browser, API, and database evidence, no silent mock fallback, and its existing contracts pass.

Written by the indexing model from the issue text.