Add checkout compliance and run traceability to all agents

Add explicit POST /api/issues/{issueId}/checkout and PATCH status
update curl templates with X-Paperclip-Run-Id headers to all agent
heartbeats. Document Gemini workspace sandboxing in Hugh's TOOLS.md.
Also removed Regina's ghost instructionsFilePath from live DB.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

engineering/hugh/TOOLS.md

@@ -6,3 +6,15 @@
 - `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
 - `pnpm paperclipai agent list` — List all agents and their status
 - `curl` — HTTP requests (e.g., loading the Paperclip skill)
+
+## Gemini Workspace Restrictions
+
+The `gemini_local` adapter sandboxes Gemini's built-in file tools (`grep_search`, `read_file`, etc.) to the workspace directory. Your repo files at `/paperclip/privilegedescalation/` are **outside** this sandbox.
+
+**Do NOT use Gemini's native file tools to access the repo.** They will fail with "Path not in workspace."
+
+Instead, use `bash` wrappers:
+
+- `cat`, `grep`, `find`, `ls` — for reading/searching files
+- `gh` — for GitHub operations
+- `curl` — for API calls