docs: update STATUS.md with code review results + repo inventory

Added provisioning code review findings (8 bugs found and fixed in
agent-identity-provisioning repo). Updated repo inventory to show
total commits per repo this session.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -24,7 +24,19 @@ stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).
   - `clone-as.sh` — per-agent git identity on clone
   - `agent-profile.sh` — sourced agent context switching (8 agents registered)
   - `bw-git-credential.sh` — git credential helper backed by Bitwarden
+- [x] **BASELINE-PROMPT.md created** — the 14 canonical agent principles (was
+      referenced everywhere but didn't exist)
+- [x] **prereq-check.sh built** — environment readiness verifier
 - [x] agent-identity-provisioning repo cloned to ~/projects/
+- [x] **Code review of provisioning automation** — found and fixed critical bugs:
+  - Email domain bug (tsys-cloudron.knel.net → turnsys.com) — would have failed all provisioning
+  - STATE_DIR at module level (crashed --dry-run/--help)
+  - IndexError on empty password_inputs list
+  - State file unreachable on exception (moved to finally)
+  - BW item_exists swallowing network errors as "not found" (duplicate creds)
+  - Dockerfile npx install with `|| true` (silent BW CLI failure)
+  - Missing .dockerignore (secrets leaking into image)
+  - Added explicit cloudron_email to agents.yaml.example
 
 ### Previous agent (reachableceo)
 - [x] Complete planning docs (org-buildout repo — 7 files)
@@ -84,8 +96,8 @@ docker compose run --rm provision --agent vp-techops
 
 ## Repo Inventory
 
-| Repo | Location | Status |
-|---|---|---|
-| org-buildout (this repo) | ~/org-buildout | Cloned, AGENTS.md committed, can't push |
-| agent-identity-provisioning | ~/projects/agent-identity-provisioning | Cloned, not modified |
-| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | Created from template + 4 new scripts, 2 commits, not pushed to Gitea |
+| Repo | Location | Commits this session | Status |
+|---|---|---|---|
+| org-buildout (this repo) | ~/org-buildout | 3 (AGENTS.md, STATUS.md, questions-v1.md) | Can't push (no Gitea auth) |
+| agent-identity-provisioning | ~/projects/agent-identity-provisioning | 1 (critical bug fixes) | Can't push (no Gitea auth) |
+| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | 5 (framework + 4 scripts + BASELINE-PROMPT.md + prereq-check.sh) | Can't push (no Gitea auth, repo doesn't exist on Gitea yet) |