ops(scripts): dispatch, queue gating, heartbeat, quota probe

dispatch-turn.sh (headless turn launcher with TURN_MODEL routing),
queue-after.sh (serial gate chain + quota-wall guard), pmo-heartbeat.sh
(PMO wake loop), quota-probe-then-chain.sh (post-wall relaunch).

scripts/root-fix-tooling-perms.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# root-fix-tooling-perms.sh — make _crossfeed/tooling uniformly group-writable
+# (collaboration across agent accounts) while keeping credentials/ locked down.
+# Usage: sudo bash ~/.coordinate/scripts/root-fix-tooling-perms.sh
+set -euo pipefail
+[ "$(id -u)" -eq 0 ] || { echo "ERROR: run with sudo"; exit 1; }
+
+T=/home/_crossfeed/tooling
+[ -d "$T" ] || { echo "ERROR: $T missing"; exit 1; }
+
+chgrp -R users "$T"
+# group rw, but NEVER widen credentials/ (skip symlinks; dangling links OK)
+find "$T" -path "$T/credentials" -prune -o ! -type l -print0 | xargs -0 -r chmod g+rwX || true
+find "$T" -path "$T/credentials" -prune -o -type d -print0 | xargs -0 -r chmod g+s || true
+# lock credentials to owner only
+chgrp -R reachableceo "$T/credentials" 2>/dev/null || true
+chmod -R o-rwx,g-rwx "$T/credentials" || true
+
+echo "OK: tooling group-writable (setgid dirs), credentials owner-only"