fix(b00t): repair datum graph (78→0 errors) + blessing role-lookup bug

[elasticdotventures]

Summary

Three commits, building on each other:

1. PRD-10 Phase 1 desktop agent (b678b7b2) — bumps the vendor/ledgrrr submodule to its ledgrrr-mcp controller implementation (all 11 ledgrrr_* MCP tools, real status/render/simulate/export-office, 17/17 tests) and publishes the 6 required ledgrrr.* b00t datums.
2. Datum graph repair + blessing.rs fix (77b30a46) — the commit-hook's datum validate --graph check was already failing with 78 dangling references before this branch touched anything (confirmed by removing the new ledgrrr datums and getting the identical count). This commit takes it to 0, and fixes a related Rust bug discovered along the way.

What's in the datum-graph fix

• 22× removed entangled_cli = ["X.cli"] self-references on MCP datums where no such CLI datum was ever created (copy-paste cruft).
• Reference corrections: cargo.cli → rustc.cli (×2), llama-server → llama-cpp-server.container (this store keys subject references by filename-derived type token, not the internal type = field — the two disagree on that file), bare "node" → "node.cli".
• 3 new minimal datums for real gaps: node.cli, docker.cli (detect-only, no fabricated install script) and pgadmin.docker (mirrors postgres-enhanced.docker.toml).
• 41 new skill datums closing the skills = [...] cluster across role datums. Every one maps to a real, verifiable b00t-cli command, workspace crate, or documented hive concept (see each datum's [b00t.learn] content). 17 of the 41 are marked # 🦨 unfinished with a stated reason where the mapping is inferred rather than a literal match — tracked so they're easy to find and firm up later.
• bouncer → handoff rename at the skill-naming layer only, per current multi-agent nomenclature. The real b00t-cli bouncer subcommand and [b00t.agent.bouncer] gate tables are untouched (flagged on handoff.skill.toml as a separate, larger rename).
• One reference ("tdd/verification gating") contained a literal slash that can't be a filename — confirmed the graph loader doesn't scan subdirectories, so the reference was renamed to tdd-verification-gating rather than faking a path.

Rust fix: b00t-cli/src/commands/blessing.rs

blessing --manifest --role=X resolved role datums via datums.get(role) — a bare-name key that never matches this store's name.type keying — then fell back to datums.values().find(datum_type == Role) with no name filter at all.

Verified live before the fix: --role operator silently returned an empty manifest despite operator.role.toml having a real depends_on, while --role executive only worked because a bare-named executive.toml workaround happened to exist. The unfiltered fallback is worse than empty — it can silently hand back an unrelated role's tool-authorization manifest.

Replaced with find_role_datum(): exact "{role}.role" key first, then bare key, then a name-prefix search that deterministically prefers a Role-typed match (sorted, not HashMap-iteration-order-dependent). 3 new regression tests. Confirmed fixed live — operator and worker now resolve correctly.

Surfaced but not resolved (needs a product decision)

"executive" has three divergent definitions: executive.toml (bare workaround), executive.role.toml (original, has depends_on), and executive.role.tomllm (richer/more current, shadows the .toml per this store's .tomllmd > .tomllm > .toml precedence, but is missing depends_on — which is why --role executive still comes up empty even after the blessing.rs fix). Not merged here — reconciling three human-authored drafts isn't a call I should make unilaterally.

Test plan

• cargo test -p b00t-cli --lib commands::blessing:: — 7/7 pass (4 existing + 3 new regression tests)
• ./target/debug/b00t-cli --path _b00t_ datum validate --graph — datum graph: valid (490 datums), 0 errors (down from 78)
• Live verification: blessing --manifest --role operator/worker now return real manifests; --role executive still empty (documented, separate issue)
• cargo test -p ledgerr-desktop-agent (submodule) — 17/17 pass
• Pre-commit hook passed cleanly (no --no-verify) on the final commit

🤖 Generated with Claude Code