feat(orchestrator): mount the host's agents-council state read-only as /kept

The W4 resources view reads gates.db and the resources/ files of the host sampler. The installer creates ~/.local/state/agents-council/resources and writes KVB_ORCHESTRATOR_KEPT into .env; compose binds it read-only at /kept without creating the host path, and the server passes --kept to the hub.

🎯 Fix: 90 %
💥 Break: 3 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 87
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/hub_case.py

@@ -47,11 +47,12 @@ class HubCase(unittest.TestCase):
         self.projects = base / "projects"
         self.tree_file = base / "tree" / "branch-tree.json"
         self.timers = base / "timers"
+        self.kept = base / "kept"
         self.cleanup = base / "state" / "cleanup"
         self.offices = base / "state" / "offices"
         self.approvers = base / "config" / "approvers.json"
         self.replay = base / "replay"
-        for path in (self.pages, self.state, self.outside, self.projects, self.tree_file.parent, self.timers):
+        for path in (self.pages, self.state, self.outside, self.projects, self.tree_file.parent, self.timers, self.kept):
             path.mkdir()
         silence = mock.patch.object(server.Handler, "log_message")
         silence.start()
@@ -70,7 +71,7 @@ class HubCase(unittest.TestCase):
             transcripts=self.projects,
             scripts=self.scripts,
             templates=HUB / "templates",
-            places=server.Places(tree_file=self.tree_file, timers=self.timers, vendor=HUB / "vendor", cleanup=self.cleanup, offices=self.offices),
+            places=server.Places(tree_file=self.tree_file, timers=self.timers, vendor=HUB / "vendor", cleanup=self.cleanup, offices=self.offices, kept=self.kept),
             model=server.Model(url="", model="", key=""),
             engines=self.engines,
             approvers=self.approvers,

tests/test_hub_speech.py

@@ -175,7 +175,7 @@ class TestHubSpeech(HubCase):
         args = {
             "--bind": "127.0.0.1", "--listen-port": "0", "--public-port": "1", "--council": str(self.council), "--pages": str(self.pages), "--state": str(self.state),
             "--host-state": str(HOST_STATE), "--skills": str(self.outside), "--transcripts": str(self.projects), "--templates": str(HUB / "templates"),
-            "--tree-file": str(self.tree_file), "--timers": str(self.timers), "--vendor": str(HUB / "vendor"), "--cleanup": str(self.cleanup), "--offices": str(self.offices),
+            "--tree-file": str(self.tree_file), "--timers": str(self.timers), "--kept": str(self.kept), "--vendor": str(HUB / "vendor"), "--cleanup": str(self.cleanup), "--offices": str(self.offices),
             "--llm-key-file": os.devnull, "--llm-url": "", "--llm-model": "",
             "--piper": str(self.engines.piper), "--voices": str(self.engines.voices), "--operator-voice": "en_US-test-high:9", "--whisper": str(self.engines.whisper),
             "--whisper-model": str(self.engines.whisper_model), "--scratch": str(self.engines.scratch), "--approvers": str(self.approvers),