fix(protocol): implement Identity Isolation to prevent task pollution

Research revealed that agent identities (consolidated to bd beads) were appearing in standard task lists because the data-access layer lacked identity-awareness.
- Refactored read-issues.ts and parser.ts to explicitly exclude beads labeled 'gt:agent' from standard mission flows.
- Verified that agent personas remain targetable by the registry but are invisible to Kanban/Graph/Sessions.
- Added Characterization Test: identity-isolation.test.ts.

This restores the 'War Room' clarity by separating Operatives from Missions.

OPERATIVE: silver-castle
SESSION: 2026-02-14-1630

src/lib/parser.ts

@@ -81,6 +81,11 @@ export function parseIssuesJsonl(text: string, options: ParseIssuesOptions = {})
         continue;
       }
 
+      // Exclude agent identities from standard mission lists
+      if (normalized.labels.includes('gt:agent')) {
+        continue;
+      }
+
       issues.push(normalized);
     } catch {
       // Skip malformed lines to keep parser resilient against partial writes.

src/lib/read-issues.ts

@@ -105,7 +105,13 @@ async function readIssuesViaBd(options: ReadIssuesOptions, project: ReturnType<t
     return parsed
       .map((issue) => normalizeBdIssue(issue))
       .filter((issue): issue is BeadIssue => issue !== null)
-      .filter((issue) => (options.includeTombstones ?? false ? true : issue.status !== 'tombstone'))
+      .filter((issue) => {
+        // Exclude tombstones
+        if (issue.status === 'tombstone' && !options.includeTombstones) return false;
+        // Exclude agent identities from mission lists
+        if (issue.labels.includes('gt:agent')) return false;
+        return true;
+      })
       .map((issue) => ({
         ...issue,
         project,