feat: expand agents (10), skills (20), and hooks (11) with profile system

Agents:
- Add YAML frontmatter (model, tools) to all 7 existing agents
- New agents: planner (opus), build-error-resolver (sonnet), loop-operator (sonnet)

Skills:
- search-first: research before building (Adopt/Extend/Compose/Build)
- verification-loop: full quality gate pipeline (Build→TypeCheck→Lint→Test→Security→Diff)
- strategic-compact: when and how to run /compact effectively
- autonomous-loops: 6 patterns for autonomous agent workflows
- continuous-learning: extract session learnings into instincts

Hooks:
- Profile system (minimal/standard/strict) via run-with-profile.sh
- config-protection: block linter/formatter config edits (standard)
- suggest-compact: remind about /compact every ~50 tool calls (standard)
- auto-tmux-dev: suggest tmux for dev servers (standard)
- session-save/session-load: persist and restore session context (Stop/SessionStart)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agents/README.md

@@ -4,15 +4,30 @@ This directory contains specialized AI agent profiles. Each profile defines a ro
 
 ## Available Agents
 
-| Agent                | File                      | Use When                                                 |
-| -------------------- | ------------------------- | -------------------------------------------------------- |
-| Frontend Architect   | `frontend-architect.md`   | UI components, performance, accessibility, React/Next.js |
-| Backend Architect    | `backend-architect.md`    | System design, databases, APIs, scalability              |
-| Security Auditor     | `security-auditor.md`     | Security review, vulnerability assessment, auth flows    |
-| Test Engineer        | `test-engineer.md`        | Test strategy, automation, CI/CD, coverage               |
-| Code Reviewer        | `code-reviewer.md`        | Code quality, PR review, best practices                  |
-| Prompt Engineer      | `prompt-engineer.md`      | LLM prompts, agent instructions, prompt optimization     |
-| Documentation Expert | `documentation-expert.md` | Technical writing, user/admin guides, docs maintenance   |
+| Agent                | File                      | Model  | Use When                                                 |
+| -------------------- | ------------------------- | ------ | -------------------------------------------------------- |
+| Planner              | `planner.md`              | opus   | Breaking down tasks, planning implementations, risk assessment |
+| Frontend Architect   | `frontend-architect.md`   | opus   | UI components, performance, accessibility, React/Next.js |
+| Backend Architect    | `backend-architect.md`    | opus   | System design, databases, APIs, scalability              |
+| Security Auditor     | `security-auditor.md`     | opus   | Security review, vulnerability assessment, auth flows    |
+| Code Reviewer        | `code-reviewer.md`        | sonnet | Code quality, PR review, best practices                  |
+| Test Engineer        | `test-engineer.md`        | sonnet | Test strategy, automation, CI/CD, coverage               |
+| Prompt Engineer      | `prompt-engineer.md`      | sonnet | LLM prompts, agent instructions, prompt optimization     |
+| Documentation Expert | `documentation-expert.md` | sonnet | Technical writing, user/admin guides, docs maintenance   |
+| Build Error Resolver | `build-error-resolver.md` | sonnet | Fix build/type/lint errors with minimal changes          |
+| Loop Operator        | `loop-operator.md`        | sonnet | Monitor autonomous loops, detect stalls, escalate        |
+
+## Model Selection
+
+- **opus** — Deep reasoning tasks: planning, architecture, security review. Slower but more thorough.
+- **sonnet** — Implementation tasks: code review, testing, writing, fixing. Faster turnaround.
+
+## Tool Restrictions
+
+Each agent declares a `tools` array in its frontmatter, following the principle of least privilege:
+- **Read-only agents** (planner, architects): Read, Glob, Grep — they advise, not implement
+- **Implementation agents** (test-engineer, build-error-resolver): Read, Glob, Grep, Edit, Write, Bash
+- **Review agents** (code-reviewer): Read, Glob, Grep, Bash (for git commands)
 
 ## Agent Selection
 
@@ -64,7 +79,9 @@ When context7 documentation contradicts training knowledge, **trust context7**.
 ## Adding a New Agent
 
 1. Create a new `.md` file in this directory
-2. Use consistent frontmatter: `name` and `description`
+2. Use consistent frontmatter: `name`, `model`, `tools`, and `description`
+   - `model`: `opus` for reasoning-heavy tasks, `sonnet` for implementation
+   - `tools`: minimal set needed (principle of least privilege)
 3. Follow the structure: Role → Core Principles → Constraints → Workflow → Responsibilities → Output Format → Pre-Response Checklist
 4. Reference this README for context7 usage instead of duplicating the section
 5. Update `DOCS.md` and `README.md` to list the new agent