refactor(skills): cleanup dead code + full workflow A→B→C→D integration

Cleanup:
- Remove unused validate_yaml() helper from lib.sh
- Remove USER_MANUAL.html + mqtt-broker-setup.html (no refs found)

Workflow A (create_session ↔ delegate-job):
- Add --submit-job <prompt> option to create_session.sh
- Auto-register session in delegate-job registry, store delegate_job_id in YAML

Workflow B (push-based monitor):
- Migrate reconcile.sh to MQTT subscriber mode (polling fallback preserved)

Workflow C (unified status):
- status.sh now shows session + delegate-job state in single column

Workflow D (audit log + perms):
- JSON job files chmod 600
- create/delete/resume now publish lifecycle events to delegate-job

skills/agent-sessions-monitor/SKILL.md

@@ -98,11 +98,12 @@ bash ~/PuKi/lab/agent_sessions/skills/agent-sessions-monitor/scripts/reconcile.s
 
 # Read-only: compute drift WITHOUT writing the YAML (use for "what's running?" checks).
 bash ~/PuKi/lab/agent_sessions/skills/agent-sessions-monitor/scripts/reconcile.sh --once --emit-diff --dry-run
+
+# Push-based MQTT Monitor: listen to delegated job events on the broker and update the YAML instantly.
+bash ~/PuKi/lab/agent_sessions/skills/agent-sessions-monitor/scripts/reconcile.sh --subscribe
 ```
 
-Flags: `--once` (single pass), `--emit-diff` (print JSON), `--dry-run` (P1-E — no
-mutation). There are **no** `--workspace` / `--agent` / `--comment-card` flags; the
-worker turns the emitted JSON `drifts[]` into `kanban_comment` calls itself.
+Flags: `--once` (single pass), `--emit-diff` (print JSON), `--dry-run` (P1-E — no mutation), `--subscribe` (persistent push-based MQTT subscription monitoring; falls back to polling if connection fails). There are **no** `--workspace` / `--agent` / `--comment-card` flags; the worker turns the emitted JSON `drifts[]` into `kanban_comment` calls itself.
 
 ## Drift classes (what the script handles)