fix(protocol): implement Identity Isolation to prevent task pollution

Research revealed that agent identities (consolidated to bd beads) were appearing in standard task lists because the data-access layer lacked identity-awareness.
- Refactored read-issues.ts and parser.ts to explicitly exclude beads labeled 'gt:agent' from standard mission flows.
- Verified that agent personas remain targetable by the registry but are invisible to Kanban/Graph/Sessions.
- Added Characterization Test: identity-isolation.test.ts.

This restores the 'War Room' clarity by separating Operatives from Missions.

OPERATIVE: silver-castle
SESSION: 2026-02-14-1630

tests/lib/identity-isolation.test.ts

@@ -0,0 +1,15 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseIssuesJsonl } from '../../src/lib/parser';
+
+test('parseIssuesJsonl filters out gt:agent beads', () => {
+  const jsonl = [
+    JSON.stringify({ id: 'bb-1', title: 'Real Mission', status: 'open', labels: [] }),
+    JSON.stringify({ id: 'bb-agent', title: 'Agent Persona', status: 'open', labels: ['gt:agent'] }),
+  ].join('\n');
+
+  const issues = parseIssuesJsonl(jsonl);
+  assert.equal(issues.length, 1, 'Should only find 1 issue');
+  assert.equal(issues[0].id, 'bb-1');
+  assert.ok(!issues.find(i => i.id === 'bb-agent'), 'Should have filtered the agent persona');
+});