v0.18.0: MCP entity-graph CRUD, lifecycle validation, curl -o /dev/null fix

- create_entity, set_entity_state, end_relationship MCP tools
- update_entity_attributes now triggers check derivation via EnsureEntityChecks
- shared db.EnsureEntityChecks + db.ValidateTransition hooks (HTTP + MCP parity)
- curl -o /dev/null now classified read_only (was config_mutation)
- db.ErrTransitionInvalid sentinel for HTTP error-type accuracy
- SOUL.md: capability escalation, self-grounding, exploration budget rules
- Runbook: oikos check lifecycle for agent self-knowledge

internal/httpapi/default_checks.go

@@ -3,31 +3,22 @@ package httpapi
 import (
 	"context"
 
-	"github.com/dtoro/oikos/internal/checkdefaults"
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 )
 
 // ensureDefaultChecks derives an entity's default checks from the monitoring
-// kinds its type declares.
+// kinds its type declares. Thin wrapper over the shared db.EnsureEntityChecks
+// hook so the HTTP create/patch paths and the MCP entity-mutation tools stay
+// in lockstep.
 //
-// Note the ordering caveat: an entity created through the API usually has no
-// edges yet, so a type whose address comes from its host (a service) will
-// produce no checks on this pass. That gap is real and deliberately visible —
-// coverageSweep reports it, and the next inventory ingest fills it in once
-// the hosting edge exists.
+// Note the ordering caveat (carried from db.LoadTypeTree / checkdefaults.Ensure):
+// an entity created through the API usually has no edges yet, so a type whose
+// address comes from its host (a service) will produce no checks on this pass.
+// That gap is real and deliberately visible — coverageSweep reports it, and
+// the next inventory ingest fills it in once the hosting edge exists.
 func ensureDefaultChecks(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType, name string, attrsJSON []byte) error {
-	tree, err := db.LoadTypeTree(ctx, tx)
-	if err != nil {
-		return err
-	}
-	res, err := checkdefaults.Ensure(ctx, tx, tree, checkdefaults.Target{
-		ID: entityID, Slug: slug, Type: entityType, Name: name, Attrs: attrsJSON,
-	})
-	if err != nil {
-		return err
-	}
-	checkdefaults.LogResult(slug, entityType, res)
-	return nil
+	_, err := db.EnsureEntityChecks(ctx, tx, entityID, slug, entityType, name, attrsJSON)
+	return err
 }