Standardize TOOLS.md across all agents

- Consistent table format with GitHub auth, Paperclip API, and tool inventory
- Added git, jq, node/npm/pnpm, python3, pnpm paperclipai to all agents
- Added repo ownership map for CEO/CTO
- Removed stale Gemini workspace section from Hugh (runs claude_local)
- Added opencode_local adapter notes to Regina (promptTemplate required)
- Flagged missing pod tools (docker, kubectl, flux)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

engineering/hugh/TOOLS.md

@@ -1,20 +1,29 @@
 # Hugh Hackman — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — PRs, issues, CI runs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `node` / `npm` / `pnpm` / `npx` | Node.js runtime and package management |
+| `python3` | Python scripting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
 
-## Gemini Workspace Restrictions
-
-The `gemini_local` adapter sandboxes Gemini's built-in file tools (`grep_search`, `read_file`, etc.) to the workspace directory. Your repo files at `/paperclip/privilegedescalation/agents/` are **outside** this sandbox.
-
-**Do NOT use Gemini's native file tools to access the repo.** They will fail with "Path not in workspace."
-
-Instead, use `bash` wrappers:
-
-- `cat`, `grep`, `find`, `ls` — for reading/searching files
-- `gh` — for GitHub operations
-- `curl` — for API calls
+> **Not installed:** `docker`, `kubectl`, `flux`. Infrastructure work requiring these must go through GitHub Actions CI/CD or request board intervention for pod-level installs.