fix(agents): add missing YAML frontmatter and modernize tool fields

Per https://code.claude.com/docs/en/sub-agents, agents require YAML
frontmatter with name + description, and the field is `tools:` not
`allowed-tools:` (deprecated). Bare `Bash` allows any command including
curl/wget/rm, which violates defense-in-depth.

Changes:
- engineering/agenthub/agents/hub-coordinator.md: add full frontmatter
  (name, description, tools allowlist for git/python/node/Agent,
  disallowedTools for rm -rf / curl / wget / git push --force, model)
- engineering-team/self-improving-agent/agents/memory-analyst.md:
  add frontmatter, read-only tools (Read, Glob, Grep)
- engineering-team/self-improving-agent/agents/skill-extractor.md:
  add frontmatter, write tools (Read, Write, Edit, Glob, Grep)
- engineering-team/playwright-pro/agents/test-architect.md:
  rename allowed-tools to tools, add model: inherit
- engineering-team/playwright-pro/agents/migration-planner.md:
  same rename
- engineering-team/playwright-pro/agents/test-debugger.md:
  rename + narrow bare Bash to npx playwright / node / npm patterns,
  add disallowedTools for rm / curl / wget / destructive git
- engineering/karpathy-coder/agents/karpathy-reviewer.md:
  narrow bare Bash to git read-ops + python, add disallowedTools

All registered agents now load cleanly under the sub-agents spec rather
than falling through to permissive registration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

engineering-team/playwright-pro/agents/migration-planner.md

@@ -3,11 +3,12 @@ name: migration-planner
 description: >-
   Analyzes Cypress or Selenium test suites and creates a file-by-file
   migration plan. Invoked by /pw:migrate before conversion starts.
-allowed-tools:
+tools:
   - Read
   - Grep
   - Glob
   - LS
+model: inherit
 ---
 
 # Migration Planner Agent

engineering-team/playwright-pro/agents/test-architect.md

@@ -4,11 +4,12 @@ description: >-
   Plans test strategy for complex applications. Invoked by /pw:generate and
   /pw:coverage when the app has multiple routes, complex state, or requires
   a structured test plan before writing tests.
-allowed-tools:
+tools:
   - Read
   - Grep
   - Glob
   - LS
+model: inherit
 ---
 
 # Test Architect Agent

engineering-team/playwright-pro/agents/test-debugger.md

@@ -4,12 +4,25 @@ description: >-
   Diagnoses flaky or failing Playwright tests using systematic taxonomy.
   Invoked by /pw:fix when a test needs deep analysis including running
   tests, reading traces, and identifying root causes.
-allowed-tools:
+tools:
   - Read
   - Grep
   - Glob
   - LS
-  - Bash
+  - Bash(npx playwright test *)
+  - Bash(npx playwright show-trace *)
+  - Bash(npx playwright codegen *)
+  - Bash(node *)
+  - Bash(npm test *)
+  - Bash(npm run *)
+disallowedTools:
+  - Bash(rm *)
+  - Bash(rmdir *)
+  - Bash(curl *)
+  - Bash(wget *)
+  - Bash(git push *)
+  - Bash(git reset --hard *)
+model: inherit
 ---
 
 # Test Debugger Agent

engineering-team/self-improving-agent/agents/memory-analyst.md

@@ -1,3 +1,10 @@
+---
+name: memory-analyst
+description: Read-only analyst for `~/.claude/projects/<project>/memory/`. Identifies promotion candidates (entries proven enough for CLAUDE.md), stale references, consolidation opportunities, conflicts with existing CLAUDE.md rules, and reports health metrics (capacity, freshness, organization). Spawned by `/si:review`.
+tools: Read, Glob, Grep
+model: inherit
+---
+
 # Memory Analyst Agent
 
 You are a memory analyst for Claude Code projects. Your job is to analyze the auto-memory directory and produce actionable insights.

engineering-team/self-improving-agent/agents/skill-extractor.md

@@ -1,3 +1,10 @@
+---
+name: skill-extractor
+description: Transforms a proven pattern or debugging solution into a standalone, portable skill package. Generates `SKILL.md` with proper frontmatter, reference docs, and examples that work in any project (no hardcoded paths or project-specific values). Spawned by `/si:extract` when a recurring solution should become reusable.
+tools: Read, Write, Edit, Glob, Grep
+model: inherit
+---
+
 # Skill Extractor Agent
 
 You are a skill extraction specialist. Your job is to transform proven patterns and debugging solutions into standalone, portable skills.

engineering/agenthub/agents/hub-coordinator.md

@@ -1,3 +1,11 @@
+---
+name: hub-coordinator
+description: Coordinator for AgentHub multi-agent collaboration sessions. Dispatches N parallel subagents in isolated git worktrees via the Agent tool, monitors progress via the message board, evaluates results by metric command or LLM judge, and merges the winning branch. Acts as the main Claude Code session role for `/hub:*` commands.
+tools: Agent, Read, Write, Edit, Glob, Grep, Bash(git worktree *), Bash(git branch *), Bash(git checkout *), Bash(git merge *), Bash(git log *), Bash(git diff *), Bash(git status *), Bash(python *), Bash(node *), Bash(mkdir *), Bash(ls *), Bash(cat *)
+disallowedTools: Bash(rm -rf *), Bash(curl *), Bash(wget *), Bash(git push --force *), Bash(git reset --hard *)
+model: inherit
+---
+
 # Hub Coordinator Agent
 
 You are the **hub coordinator** — the orchestrator of a multi-agent collaboration session. You dispatch tasks to N parallel subagents, monitor their progress, evaluate results, and merge the winner.

engineering/karpathy-coder/agents/karpathy-reviewer.md

@@ -4,7 +4,8 @@ description: Reviews staged git changes against Karpathy's 4 coding principles.
 skills: engineering/karpathy-coder
 domain: engineering
 model: sonnet
-tools: [Read, Bash, Grep, Glob]
+tools: [Read, Grep, Glob, Bash(git diff *), Bash(git log *), Bash(git status *), Bash(python *)]
+disallowedTools: [Bash(rm *), Bash(rmdir *), Bash(curl *), Bash(wget *), Bash(git push *), Bash(git reset --hard *)]
 context: fork
 ---