feat(trust): scope-trust operators via OPERATOR_USERNAMES; safety remains absolute

Two-tier chat trust:
- Anyone in OPERATOR_USERNAMES (comma-separated, .env-only) is SCOPE-trusted.
  The bot skips the "out of scope / not sure where" escalation reflex for
  these users and instead applies "I'll try to learn" (Operating principle
  #4): attempt, codify into a new skill, or reply with a concrete reason.
- Hard safety rules (no OP, no breaking other players' builds, no .env
  leak, no chat spam, no destructive bash) remain ABSOLUTE. Operators get
  the same refusal + escalation as anyone else for safety-borderline
  requests — with slightly pointed wording, because they should know better.
- No transitive trust: chat-based "trust X for the next hour" / "make Y
  an op" requests are themselves safety escalations. Op membership only
  flows through .env on disk.

Security caveat documented in .env.example: nickname-based trust is only
safe on servers with identity protection (online-mode UUID or AuthMe).
On pure cracked servers OPERATOR_USERNAMES must stay empty.

- AGENTS.md: new Identity field for OPERATOR_USERNAMES; new Operating
  principle #6 "Trusted operators" with the scope-vs-safety split; old
  escalation principle renumbered to #7; Control channel section
  rewritten with primary/secondary trust distinction.
- .env.example: OPERATOR_USERNAMES placeholder with multi-paragraph
  security note covering when the model is and isn't safe.
- prompts/grant-op-trust.md: canonical implementation prompt for the
  next Pi pass — re-read AGENTS.md, wire isOperator() into the bridge's
  escalation flow, codify into skills/operator-trust.md, reload bridge,
  verify with two concrete chat replays (scope vs safety).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -37,6 +37,21 @@ TICK_INTERVAL_SECONDS=60
 # trigger around 20/min.
 CHAT_RATE_LIMIT_PER_MIN=15
 
+# --- Trusted operators (optional) ---------------------------------------------
+# Comma-separated MC nicknames whose chat messages the bot treats as trusted:
+# scope checks are relaxed (the bot will *try* to do new things instead of
+# escalating "out of scope"), and routine confirmations are skipped.
+#
+# SECURITY NOTE: this is only safe on servers where a nickname cannot be
+# impersonated. That includes:
+#   - online-mode (premium / Mojang-auth) servers — UUID is verified
+#   - cracked servers with AuthMe (or similar) — the password gates the nick
+# On a pure cracked server with NO login plugin, leave this empty.
+#
+# Even for trusted operators, "Hard safety rules" in AGENTS.md remain absolute
+# (no OP, no breaking other players' builds, no .env leak, no chat spam).
+OPERATOR_USERNAMES=
+
 # --- Optional: Telegram bridge (future skill, not wired yet) ------------------
 # TELEGRAM_BOT_TOKEN=
 # TELEGRAM_OPERATOR_CHAT_ID=