refactor: extract compass from CHARACTER.md into runtime-loaded secret

The compass (identity, moral core) now lives outside the repo at a path
specified by EXEC_COMPASS in .env or .env.enc. The agent hard-fails if
the compass file is missing — it refuses to start without its soul.

This means the factory (dev agent, gardener, planner) can evolve the
exec's voice and relationships via PRs to CHARACTER.md, but cannot
touch the compass. Only the executive controls it directly.

- exec-session.sh: loads compass from $EXEC_COMPASS, merges with CHARACTER.md
- exec-briefing.sh: same compass loading, hard fail without it
- CHARACTER.md: compass sections replaced with runtime-load comments
- COMPASS.md.example: template for the compass file
- .env.example: added EXEC_COMPASS variable
- exec/AGENTS.md: documented compass separation and EXEC_COMPASS requirement

.env.example

@@ -54,3 +54,9 @@ BASE_RPC_URL=                              # [SECRET] on-chain RPC endpoint
 
 # ── Tuning ────────────────────────────────────────────────────────────────
 CLAUDE_TIMEOUT=7200                        # [CONFIG] max seconds per Claude invocation
+
+# ── Executive Assistant ──────────────────────────────────────────────────
+# The compass is the exec agent's core identity — it lives outside the repo
+# so the factory cannot modify it. The agent refuses to start without it.
+# See exec/COMPASS.md.example for the template.
+EXEC_COMPASS=                              # [CONFIG] path to compass file (e.g. /home/user/.disinto/compass.md)