[TheGreatAxios]

Closes CL-11933 (Slice 3 of 5 for CL-11929; stacked on cl-11932-file-approval-packages-as-a-versioned-document-kind).

Summary

• Add the presenter specialist role and @corbits-builder/presenter workflow (workflows/presenter), bound to the Medium model tier (apps/hub/src/config/models.ts) and scoped to sb-artifact:approval_package write grants.
• Add audience persona presets (ceo, cto, investor, client, end_user) in apps/hub/src/config/personas.ts and the presenting skill (workflows/presenter/skills/presenting/SKILL.md).
• Add deploy_presenter to the Coordinator's tools (apps/hub/src/projects/deploy-tools.ts), verifying that source documents are approved, pinning their artifactId@version@sha256 refs, and forwarding the project's filed design tokens (DESIGN.md and styles.css) so the deck reuses the project's visual identity.
• Add createPackageTools (apps/hub/src/artifacts/package-tools.ts) with write_deck, check_deck, and file_package (which refuses with deck_check_failed unless check_deck passed on the current .builder/deck.json).

[linear-code]

CL-11933

[corbits-triage]

Triage requests changes:

• Conventions: added code matches a code pattern

Nothing triage asked to change still fails, so this request no longer stands.

[TheGreatAxios]

The presenter role, Medium-tier workflow, audience presets, and deploy_presenter are in place. deploy_presenter deploys only the presenter workflow and refuses unapproved selected documents. Three gates do not hold.

1. Blocking. file_package can file a different audience and different sources than the hand-off. resolveAssignment in apps/hub/src/artifacts/package-tools.ts spreads the caller's audience and sources over the assignment file. deploy_presenter never writes a sealed assignment. The hub only checks that each pin's kind, version, and sha256 exist. It does not require the approved selection from the hand-off. A presenter deployed for ceo with the approved brief and build plan can file an investor package that pins only the design.

2. deploy_presenter pins the current design even when that version is not the approved one. Selected documents are checked. Design is not. deploy_coder already refuses an unapproved design. Saving tweaks files a new design version and does not approve it, and this path will attach that version.

3. The deck-check gate does not bind the bytes that get filed. { "passed": true } with no hash is accepted. check_deck hashes deck.json only. file_package still embeds whatever non-empty deck.pptx and deck.pdf are on disk, so the package can contain a deck the check did not pass.

[corbits-triage]

Triage requests changes:

• CI green: required checks are failing
  • typecheck

[corbits-triage]

Triage: Unsure

Asking a maintainer about:

• changes sensitive paths: auth: apps/hub/src/auth/agent-token-bridge.ts, locks: bun.lock

Nothing triage asked to change still fails, so this request no longer stands.