feat: org chart tree, room channel/team CRUD, and real sandboxes

[real-limitless]

Summary

Turns the org chart into a real reporting tree with per-seat bot config, lets Room and Chart manage channels and teams, replaces Hire/Fire language with Add/Remove, drops the Room/Harness/Chart chip, and stops defaulting Cloud Agent installs to mock sandboxes.

Seat rows now persist prompt, skills, and preferred_models (Alembic 018). GET /chart and GET /seats hide Floor unless ?include_system=true. Floor stays in the backend so Conductor still compiles runs. Saving a seat copies prompt/tools/models into the OpenCode harness pack when the sandbox is running.

The Chart UI always loads system seats for topology, then hides Floor unless Show system seats is on. Children of a hidden conductor promote to the next visible ancestor so You stays the root. New seats default their reports-to to the human board seat.

Sandboxes on nested Cloud Agent kernels: /dev/kvm is present but KVM_CREATE_VCPU hits kvm_spurious_fault in alloc_loaded_vmcs, so microsandbox never reaches agent.sock. The agent now probes vCPU create in a child process and, when that fails, boots the same Fedora guest image as a sibling Docker container (sdk: container, mock: false). OpenCode still runs inside the guest. Do not flip SANDBOX_MOCK=true.

PatternFly UX (this pass): Org chart is a project-bar button (no left-nav item); /overview redirects to Playground. The reporting tree zooms (buttons + Ctrl/Cmd+wheel). Inspector skills/models/tools use PatternFly typeahead multi-select — selected tools only, with allow/ask/deny. Room channels/teams use PatternFly Nav, add-via-modal, and kebab delete. Seat click opens Mention / Add to channel / Advanced conversation. Advanced conversation opens a named Terminal session (@slug); the toolbar no longer prints sandbox breadcrumbs. PatternFly MCP is in .cursor/mcp.json.

Type of change

• New feature
• Bug fix
• Documentation / governance

Checklist

• I branched from Development-Everflow (product code) unless this is CORE-only docs.
• DCO: every commit is signed off (git commit -s). I certify the Developer Certificate of Origin.
• No secrets (.env, keys, tokens) are included.
• Docs updated if install, runtime, or operator behavior changed.
• Full-stack changes were validated under Docker Compose or Podman Compose (not host-only UI/API processes).
• I have read CONTRIBUTING.md, CODE_OF_CONDUCT.md, and OPEN_SOURCE.md.

Test plan

• PYTHONPATH=. python3 -m pytest tests/test_org_room_bus.py — 13 passed (chart hides Floor, PATCH prompt/skills/models, add/remove seat, channel/team create+delete, reports-to cycle rejected).
• npx tsc -b in everflow-platform-ui.
• Compose docker-compose.dev.yml with SANDBOX_MOCK=false and guest image at localhost:5000/everflow/everflow-sandbox-guest:latest.
• GET /api/v1/ready reports mock: false. On a healthy KVM host sdk is microsandbox; on this nested Cloud Agent kernel it is container with kvm_usable: false.
• Recreate Ship Train sandbox → status: running in seconds (not a 3-minute relay timeout). opencode --version and /opencode/ensure succeed in the guest.
• Browser: sign in, open Ship Train. Org chart button on the project bar (no left-nav Org chart). Chart zoom + inspector typeaheads. Room Nav + add modals + seat menu (Mention vs Advanced conversation). Terminal tab shows session name only.

Notes for reviewers

• Local .env is not committed. Cloud Agent scripts/cloud-agent/install.sh writes SANDBOX_MOCK=false only when creating .env.
• Guest seed is a real blocker if the image is missing; do not flip mock back on.
• Preferred models is a pool on the seat (same idea as AgentsPanel), not a new model-group type. First model is written as the OpenCode model on harness sync.
• Container fallback needs /var/run/docker.sock (and a docker CLI) mounted into sandbox-agent. Compose already does this. Hosts with working KVM_CREATE_VCPU still use microsandbox microVMs.