refactor: extract compass from CHARACTER.md into runtime-loaded secret

The compass (identity, moral core) now lives outside the repo at a path
specified by EXEC_COMPASS in .env or .env.enc. The agent hard-fails if
the compass file is missing — it refuses to start without its soul.

This means the factory (dev agent, gardener, planner) can evolve the
exec's voice and relationships via PRs to CHARACTER.md, but cannot
touch the compass. Only the executive controls it directly.

- exec-session.sh: loads compass from $EXEC_COMPASS, merges with CHARACTER.md
- exec-briefing.sh: same compass loading, hard fail without it
- CHARACTER.md: compass sections replaced with runtime-load comments
- COMPASS.md.example: template for the compass file
- .env.example: added EXEC_COMPASS variable
- exec/AGENTS.md: documented compass separation and EXEC_COMPASS requirement

exec/exec-briefing.sh

@@ -43,13 +43,26 @@ check_memory 2000
 
 log "--- Exec briefing start ---"
 
-# ── Load character ──────────────────────────────────────────────────────
+# ── Load compass (required) ────────────────────────────────────────────
+COMPASS_FILE="${EXEC_COMPASS:-}"
+if [ -z "$COMPASS_FILE" ] || [ ! -f "$COMPASS_FILE" ]; then
+  log "FATAL: EXEC_COMPASS not set or file not found — exec agent refuses to start without its compass"
+  exit 1
+fi
+COMPASS_BLOCK=$(cat "$COMPASS_FILE")
+
+# ── Load character (voice/relationships from repo) ────────────────────
 CHARACTER_FILE="${EXEC_CHARACTER:-$SCRIPT_DIR/CHARACTER.md}"
 CHARACTER_BLOCK=""
 if [ -f "$CHARACTER_FILE" ]; then
   CHARACTER_BLOCK=$(cat "$CHARACTER_FILE")
 fi
 
+# Merge: compass first, then character
+CHARACTER_BLOCK="${COMPASS_BLOCK}
+
+${CHARACTER_BLOCK}"
+
 # ── Load memory ─────────────────────────────────────────────────────────
 MEMORY_BLOCK="(no previous memory)"
 MEMORY_FILE="$PROJECT_REPO_ROOT/exec/MEMORY.md"