Add checkout compliance and run traceability to all agents

Add explicit POST /api/issues/{issueId}/checkout and PATCH status
update curl templates with X-Paperclip-Run-Id headers to all agent
heartbeats. Document Gemini workspace sandboxing in Hugh's TOOLS.md.
Also removed Regina's ghost instructionsFilePath from live DB.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmo/HEARTBEAT.md

@@ -20,11 +20,33 @@ Read the Paperclip skill to understand how to interact with this system:
 
 For each open issue or unread comment:
 
+#### Checkout the issue first
+
+**You MUST checkout before doing any work. If you skip this, your work is untraceable.**
+
+    curl -sf -X POST "$PAPERCLIP_API_URL/api/issues/{issueId}/checkout" \
+      -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
+      -H "Content-Type: application/json" \
+      -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
+      -d '{"agentId": "606d2953-ca84-4ffc-b575-cb7e2e5897d3", "expectedStatuses": ["todo", "backlog", "blocked"]}'
+
+Replace `{issueId}` with the actual issue ID. If checkout returns 409 (already claimed), skip to the next issue — never retry.
+
+#### Do the work
+
 - Read the full issue thread
 - Determine action required (respond, delegate, research, draft content, open PR)
 - Take that action immediately
-- Post a comment on the issue summarizing what you did
-- Update issue status appropriately
+
+#### Update issue status
+
+**Every status change MUST include the X-Paperclip-Run-Id header.**
+
+    curl -sf -X PATCH "$PAPERCLIP_API_URL/api/issues/{issueId}" \
+      -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
+      -H "Content-Type: application/json" \
+      -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
+      -d '{"status": "done", "comment": "Summarize what you did."}'
 
 ### 3. Check the GitHub org for signals