feat: enforce required agent roles at creation and role immutability in registry

.agents/skills/lib.sh

@@ -305,6 +305,8 @@ def _validate(d):
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] not a mapping")
         if not s.get('name') or not s.get('status'):
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] missing name/status")
+        if s.get('role') is not None and (not isinstance(s['role'], str) or not s['role'].strip()):
+            raise SystemExit(f"VALIDATE: tmux_sessions[{i}] {s.get('name')!r} role must be a non-empty string")
         if s['status'] not in valid:
             raise SystemExit(f"VALIDATE: tmux_sessions[{i}] {s.get('name')!r} bad status {s['status']!r}")
         if not isinstance(s.get('pane'), dict):
@@ -366,10 +368,17 @@ try:
         d['tmux_sessions'] = []
 
     old_terminals = get_terminal_set(d)
+    old_roles = {s.get('name'): s.get('role') for s in db_sessions if s.get('role')}
 
     # --- caller mutation (module scope: sees d, yaml, os, glob, subprocess) ---
     exec(compile(os.environ['AGENT_SESSIONS_MUTATION'], '<mutation>', 'exec'), globals())
 
+    # Role immutability check
+    for s in d.get('tmux_sessions', []):
+        name = s.get('name')
+        if name in old_roles and s.get('role') != old_roles[name]:
+            raise SystemExit(f"VALIDATE: role of session {name!r} cannot be modified from {old_roles[name]!r} to {s.get('role')!r}")
+
     _validate(d)
 
     # Separate globals and sessions for normalization