feat(paperclip): close 11 integration gaps (#16-#28)

Brings the legal-ai ↔ Paperclip integration in line with the official
Paperclip skill. Net effect: HEARTBEAT.md -47% (370→195 lines), all 14
agents on uniform runtime_config + budget + instructionsBundleMode, and
two cross-company helpers replacing manual SQL.

Highlights:
- HEARTBEAT.md refactor: project-specific only, delegates to the official
  paperclipai/paperclip skill (loaded per agent). Adds heartbeat-context
  fast-path (§1.7) and PAPERCLIP_WAKE_PAYLOAD_JSON shortcut (§1.5).
- Issue Thread Interactions API: legal-ceo.md now uses
  ask_user_questions / request_confirmation / suggest_tasks instead of
  free-text comments — gives chair structured UI with idempotency keys.
- pc.sh + paperclip_api.pc_request: every API call goes through helpers
  that inject Authorization + X-Paperclip-Run-Id (audit trail).
- sync_agents_across_companies.py: master(CMP)→mirror(CMPA) sync via
  Paperclip API, idempotent, with --verify and --apply modes.
- skills/new-company-setup: 11-step blueprint distilling all 11 gaps
  into a single onboarding runbook for the next company.
- .taskmaster: 12 tasks covering each gap (one already closed: #29).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/pc.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# pc.sh — Paperclip API wrapper for agents.
+#
+# Usage:
+#   pc.sh <method> <path> [body_json] [extra_curl_args...]
+#
+# Adds:
+#   - Authorization: Bearer $PAPERCLIP_API_KEY
+#   - X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID  (audit trail; falls back to JWT claims if empty)
+#   - Content-Type: application/json  (when body provided)
+#   - Base URL: $PAPERCLIP_API_URL
+#
+# Examples:
+#   ~/legal-ai/scripts/pc.sh GET   "/api/agents/me/inbox-lite"
+#   ~/legal-ai/scripts/pc.sh POST  "/api/issues/$ISSUE_ID/checkout"
+#   ~/legal-ai/scripts/pc.sh POST  "/api/issues/$ISSUE_ID/comments" '{"body":"שלום"}'
+#   ~/legal-ai/scripts/pc.sh PATCH "/api/issues/$ISSUE_ID" '{"status":"done"}'
+#   ~/legal-ai/scripts/pc.sh DELETE "/api/issues/$ISSUE_ID"
+#
+# Sourcing as a function (optional):
+#   source ~/legal-ai/scripts/pc.sh && pc POST "/api/issues/$ISSUE_ID/checkout"
+
+set -euo pipefail
+
+pc() {
+  local method="${1:-}"
+  local path="${2:-}"
+  local body="${3:-}"
+  if [ $# -ge 3 ]; then shift 3; else shift "$#"; fi
+
+  if [ -z "$method" ] || [ -z "$path" ]; then
+    echo "usage: pc.sh <METHOD> <PATH> [BODY_JSON] [extra curl args...]" >&2
+    return 2
+  fi
+  : "${PAPERCLIP_API_URL:?PAPERCLIP_API_URL not set}"
+  : "${PAPERCLIP_API_KEY:?PAPERCLIP_API_KEY not set}"
+
+  local args=(-s -X "$method"
+    -H "Authorization: Bearer $PAPERCLIP_API_KEY"
+    -H "X-Paperclip-Run-Id: ${PAPERCLIP_RUN_ID:-}")
+
+  if [ -n "$body" ]; then
+    args+=(-H "Content-Type: application/json" -d "$body")
+  fi
+
+  curl "${args[@]}" "$@" "${PAPERCLIP_API_URL}${path}"
+}
+
+# When invoked directly (not sourced), forward args to pc().
+if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
+  pc "$@"
+fi