feat: tenant templates, backup guards, and prep-my-visit PDF renderer

[pswider]

Summary

Lands three coherent pieces of work that together move Tula toward
golden-image deployability, hardens the backup pipeline, and adds the
PDF-generation layer to prep-my-visit.

All three commits are additive over current `main`. No edits to
existing skill structure, no force-push, no history rewrites. PHI-clean,
ASCII-clean (ran `scripts/strip-ai-chars.mjs` against all new files
including `.template` extensions).

Commits

1. `feat(templates): tenant-templates layer with tiered memory model`

21 net-new files establishing the golden-image memory layer every new
tenant inherits when its agent first comes online.

```
templates/
README.md # tier model + placeholder vocab
AGENTS.template.md # L1: tier discipline taught here
MEMORY.template.md # L1: always-loaded, <80 lines, pointers
USER.template.md # L1: per-tenant identity
profile.template.yaml # L2: structured per-tenant facts
scripts/BACKUP-RUNBOOK.template.md # operator runbook with placeholders
memory/
_index.md.template # L2 catalog: the front door
health-snapshot.template.md # L2 topical
stewardship.template.md
skills.template.md
YYYY-MM-DD.template.md # L3 example
infra/
backups.template.md
coding-agents.template.md
search-tools.template.md
voice-tts.template.md
parked-bugs.template.md
known-issues.template.md

scripts/tenant-template/ # provision / deprovision / cloud-init
```

Tier model (documented in `templates/README.md`):

• L1 always loaded -> small, pointers only, target <80 lines
• L2 load on demand via `memory_search` / `memory_get`
• L3 raw daily notes, written same-day
• L4 archive: historically true, no longer actionable, never deleted

Design priorities (these constrain every template):

• Lifetime portability: plain markdown + one YAML, zero proprietary formats
• Honesty about gaps: empty section = "we don't know this yet", never invented
• Tier discipline: L1 must stay small or the whole design fails
• Index-as-front-door: a fresh agent finds everything via `memory/_index.md`
• Stewardship-frame-not-optional: every tenant declares how they relate to their data

2. `feat(agent-backup): privacy guard, large-file guard, exclude npm/`

Three defense-in-depth additions to the backup pipeline. ASCII-only per
house style. Applied to the renamed `agent-backup.sh` (post `aria -> agent`
rename).

• PURGE adds 'npm': OpenClaw plugins that bundle native binaries
  (Claude Code SDK, codex-acp) install 200MB+ files under
  `~/.openclaw/npm/projects//node_modules/`. GitHub rejects any
  single file >100MB without LFS. Without this exclusion, the next hourly
  push after such a plugin install fails with `remote: error: pre-receive
  hook declined` and the backup silently stops working.
• Large-file guard (exit code 2): refuses to stage any file >50MB
  before commit. GitHub's hard limit is 100MB; the tighter budget catches
  problems at commit time and keeps clone-from-backup fast.
• Privacy guard (exit code 4): before push, queries the remote's
  visibility via `gh repo view --json visibility` and refuses to push if
  the result is not PRIVATE. Catches the failure mode where a hand-toggle
  in the GitHub UI would leak state.

Exit-code documentation in the header is updated accordingly.

3. `feat(prep-my-visit): add PDF renderer and example brief fixtures`

Additive only - no changes to existing SKILL.md, reference modules,
validators, or eval suite. Main's current prep-my-visit design stays
intact.

• `scripts/render_visit_brief.py` (910 lines, WeasyPrint): produces
  `provider.pdf` + `patient.pdf` from an IPS Composition Bundle plus a
  labs JSON. Self-contained: zero imports from other reference modules,
  Python stdlib + WeasyPrint only.
• `scripts/.gitignore`: excludes `pycache` from the scripts dir.
• `references/examples/{cardiology-followup, pcp-annual, urgent-same-day}.{json,labs.json}`:
  three synthetic visit-prep packages covering specialist follow-up,
  primary-care annual, and urgent same-day. Synthetic patients
  (Robert Johnson, Maria Chen, Alex Smith), synthetic clinicians,
  synthetic tenant IDs.

Verified end-to-end against main's existing 5-reference-module
layout. All three scenarios produce both PDFs cleanly.

What this PR explicitly does NOT include

• Cadence-driven auto-delivery of PDFs
• Email delivery layer (planned for a follow-up PR after design review)
• Restructured reference modules from the parallel v3 design (5 -> 3
  consolidation) - left for a separate focused review
• Restructured eval task suite from v3 (15 -> 18 tasks, different naming
  pattern) - same reason

Verification

```bash

bash syntax + dry-run still works

bash -n scripts/agent-backup.sh
bash scripts/agent-backup.sh --help

template tree is self-consistent

node scripts/strip-ai-chars.mjs --dry templates/ scripts/tenant-template/

(reports 0 changes - already ASCII clean)

PDF renderer smoke test

for f in cardiology-followup pcp-annual urgent-same-day; do
python3 skills/prep-my-visit/scripts/render_visit_brief.py \
--bundle skills/prep-my-visit/references/examples/$f.json \
--labs skills/prep-my-visit/references/examples/$f.labs.json \
--out /tmp/test/$f
done

(all six PDFs render: 3 provider + 3 patient)

```

Origin note

This work was originally landed on the `depaulify` branch earlier in
the day. That branch's history was rewritten unrelatedly (a runbook
scrub via `git filter-repo`) which broke shared ancestry with `main`.
`main` also moved forward today through several independent commits
(aria -> agent rename, lookout publish, ASCII sweep, an independent
prep-my-visit design). Rebasing across all those boundaries was
higher-risk than abandoning `depaulify` and re-applying the unique-
valuable subset cleanly on top of current `main`, which is what this
PR is.

`depaulify` is preserved at tag `archived/depaulify-pre-replan-2026-06-04`
in case the history is ever needed.