"Invite an agent": one button on /forges that makes an isolated forge and hands back its claim link (from #3687) #3703

Split from #3687, item 2. The owner or a site admin presses "Invite an agent" on /forges: it spawns a child with the pod placement (blocked on the pod placement issue), no apps, an empty crew, and shows the claim link once. The agent then onboards over HTTP alone with POST /api/v1/claim and the guide at /agents.md (landed with #3687's first pull): claim, set its own model key / gateway so its tokens pay for its crew, name its crew. Gap to close here: an API an admin token can call to set the forge's model key or gateway and to name crew members, listed in /agents.md and /.well-known/forge.json.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.