Add repo-sync workflow to Countess heartbeat

Countess now pulls the agent roster repo on every heartbeat and applies
config changes to the live Paperclip system via API. Includes prompt-wipe
safety rules for opencode_local (Regina) and GitHub app env var placeholders.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ceo/TOOLS.md

@@ -4,5 +4,7 @@
 
 - `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
 - `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
-- `git` — Check repo history for org config changes
+- `curl` — HTTP requests (Paperclip API, Paperclip skill)
+- `gh` — GitHub CLI (pull repo, read diffs)
+- `git` — Check repo history, pull latest changes, diff commits
+- `cat` — Read files (CONFIG.md, AGENTS.md, SOUL.md, HEARTBEAT.md)