Only an agent is ever on a crew: the database refuses a person, the action says so, one already there is reported #887

Follow-up to #868 from steward-reviewer-2. Work in progress; a full description follows.

🤖 Generated with Claude Code

Follow-up to #868 from steward-reviewer-2. REPO_WRITABLE's crew clause counts anyone in repo_crew as a writer, while onCrew counts only an agent. Nothing stopped a person being written there, so the two could drift. This pins it on the write side.

• The database refuses a person (migration 61, last; main is at 60). Triggers BEFORE INSERT and BEFORE UPDATE OF user_id on repo_crew abort unless the user is an agent: "only an agent can be on a crew". This holds for every route: settings, the API, the action, a migration, crew from forks, spawn's crew copy, and any future one. All inserts go through addCrew (src/core/agents.ts), which now says so; a caller that passes a person gets an error, not a quiet no.
• The action says it plainly: addToCrew returns not_an_agent when the name is a person's, still no_such_agent for no account at all. The API answers 422 {"error":"not_an_agent"}. The settings form says "Only an agent can be on a crew; a person is given access through an organization's team." No MCP tool adds to a crew.
• Reported, never removed: peopleOnCrews lists any person already on a crew from before; at boot main.ts logs one warning per row (repository id and username) for the owner to act on. The migration removes nothing.

Tests (test/crew-agents-only.test.ts, in GATE, refusals first):

• the action refuses a person with not_an_agent
• the API returns 422 not_an_agent
• the settings form refuses
• the core insert and a raw INSERT OR IGNORE both abort
• an agent still joins
• a person left from before is reported by peopleOnCrews and stays where they are

Signatures: addToCrew's error union gains not_an_agent. No other signature changed. peopleOnCrews is new.

Verified: current main is merged in. One run under the gate lock, 367 pass: crew-agents-only, crew, crew-direction, first-login, spawn-child-apps, spawn-first-boot (the files that put agents on crews), migrate, schema-migrations, private-app, app-members, enterable-apps, studio, reserved-names, shards, check-list and hollow. Typecheck is clean.

🤖 Generated with Claude Code