feat: merge-invites.py -- wire Charles's invite file into the manifest

Parses the loose invites file (name,url per line; blank lines and
comments skipped), normalizes names (vpsecops -> vp-secops), extracts
email/username/displayName from the invite URL query params, and
merges into agents.yaml. Unknown agents are appended phase1-only.

Duplicate invite tokens are skipped loudly (stale copy-paste guard)
while valid entries still merge. Verified live: caught the svp-knel
line reusing coo's token, merged 5 agents, appended vp-investing and
vp-trading.

docker-compose.yml

@@ -21,3 +21,4 @@ services:
       - ./provision-discourse.py:/app/provision-discourse.py:ro
       - ./provision-discourse-apikey.py:/app/provision-discourse-apikey.py:ro
       - ./provision-redmine.py:/app/provision-redmine.py:ro
+      - ./merge-invites.py:/app/merge-invites.py:ro