fix: Two parallel activation paths for llama agents (ENABLE_LLAMA_AGENT vs [agents.X] TOML) (#846)

- Remove ENABLE_LLAMA_AGENT conditional block from docker-compose generation
- Remove legacy agents-llama and agents-llama-all services from docker-compose.yml
- Remove llama bot user creation code (dev-qwen, dev-qwen-nightly) from lib/forge-setup.sh
- Remove FORGE_TOKEN_LLAMA/FORGE_PASS_LLAMA environment variables from .env.example
- Add migration error check that fails when ENABLE_LLAMA_AGENT=1 is found in .env
- Update documentation: remove agents-llama entries from AGENTS.md and lib/AGENTS.md
- Delete docs/agents-llama.md (legacy documentation)
- TOML [agents.X] sections in projects/*.toml is now the canonical activation path

AGENTS.md

@@ -120,8 +120,6 @@ bash dev/phase-test.sh
 | Reproduce | `docker/reproduce/` | Bug reproduction using Playwright MCP | `formulas/reproduce.toml` |
 | Triage | `docker/reproduce/` | Deep root cause analysis | `formulas/triage.toml` |
 | Edge dispatcher | `docker/edge/` | Polls ops repo for vault actions, executes via Claude sessions | `docker/edge/dispatcher.sh` |
-| agents-llama | `docker/agents/` (same image) | Local-Qwen dev agent (`AGENT_ROLES=dev`), gated on `ENABLE_LLAMA_AGENT=1` | [docs/agents-llama.md](docs/agents-llama.md) |
-| agents-llama-all | `docker/agents/` (same image) | Local-Qwen all-roles agent (all 7 roles), profile `agents-llama-all` | [docs/agents-llama.md](docs/agents-llama.md) |
 
 > **Vault:** Being redesigned as a PR-based approval workflow (issues #73-#77).
 > See [docs/VAULT.md](docs/VAULT.md) for the vault PR workflow details.