Add wakeword command routing and the reply-only agent client

CURRENT.md

@@ -40,6 +40,17 @@ mobile draft at 390px.
   - [x] C11 preview caching: Discord-hosted image/GIF previews (WebP 320px, hash-addressed, 5 MiB
     cap, one attempt) run after every walk in both modes. Live run `...-20260916090722`:
     `previewed: 2`; thumbs served over `/api/media/<scrape>/<item>/thumb` (200).
+  - [x] C75 Wakeword routing and the reply-only agent path. Commands now need the wakeword plus a
+    space at the start of the message: default `!s`, so `!s whitelist list`. `!space`,
+    `hey!s cmd`, and bare commands no longer trigger. Settings → Commands picks a preset (`!s !x
+    !c !z !q !e !r !f !v !t !g !b`) or a custom 1-8 character string with no spaces. The
+    preferences group is `commands.wakeword`; the web handler applies it to the puppet live, and
+    the daemon re-applies it on every core connect. Trusted free-form messages now go to
+    `AgentClient` (`poc/src/agent-client.ts`) as respond-only tasks (`mode: "respond"`); the
+    harness returns `{reply}` and the daemon sends it through the normal paced path, so records
+    and the response policy apply. The Go harness still needs the respond-only branch and there is
+    no Go toolchain on this host. `test:trigger` is stale (the core rejects its `debug.emit`
+    action) — see TODO.md.
   - [x] C74 Nocturne fidelity pass from the third party. Integrated the applied tree from
     `Debug WebUI mockups(1).zip`: `tokens-status.css` (danger/warn/ok roles and the data
     scale), `style-overrides.css`, `settings-popups.css`, `polish.js`, the Phosphor