feat: live-sync heartbeat commits machine-written paths

The checkout IS the deployment and symlinks make live state (memories,
auto-learned skills, agent config, desktop settings) dirty tracked files
continuously; no commit law covered machine churn, so it accumulated
unpushed for weeks — one disk held the only copy of ~61 managed skills,
a settings fix stayed local-only, and dirty trees refused merges.

scripts/live-sync.sh (systemd user timer, ~15 min) commits ONLY the
allowlisted machine/desktop-live tiers with hooks armed, merges
origin/main, pushes, and reaps wt/* worktrees older than 7 days. Task
dirt outside the allowlist is never staged; conflicts abort and alert
via ntfy; branch guard refuses off main; never --no-verify, never force.
Black-box contract pinned by tests/live-sync.bats (9 tests, suite 36/36).

Refs #11

AGENTS.md

@@ -62,6 +62,25 @@ commit"). Applied here:
   gate is the point of the hook).
 - Messages: imperative mood, what + why, `Refs #N` when a Gitea issue exists.
 
+### Live-sync tiers (the machine is a committer too — Refs #11)
+
+The checkout is the deployment, so several tracked files are live state
+written continuously through symlinks by the harness, auto-learn, and
+desktop GUIs. "Dirty tree" is judged by the writer:
+
+| Tier | Paths | Commit law |
+|------|-------|------------|
+| Human/agent prose | `AGENTS.md`, `omp-docs/`, `scripts/`, `plugins/`, `agent/skills/` | branch → PR → Frank OK (unchanged) |
+| Machine live | `agent/memories/`, `agent/managed-skills/`, `agent/config.yml`, `agent/models.yml` | `scripts/live-sync.sh` heartbeat |
+| Desktop live | `dotfiles/` | same heartbeat |
+
+The heartbeat (systemd user timer, ~15 min) stages ONLY allowlisted tiers,
+commits with hooks armed — the secret gate included — merges `origin/main`,
+pushes, and reaps `wt/*` worktrees older than 7 days. Non-allowlist dirt is
+never committed, only surfaced. Conflicts abort and alert (ntfy); it never
+force-pushes, auto-resolves, or uses `--no-verify`. Details:
+[omp-docs/tools/live-sync.md](omp-docs/tools/live-sync.md).
+
 ## Secret gate (HARD rule)
 
 The pre-commit hook (`.githooks/pre-commit`, enabled via