verify-brigadelisted

# Verify Brigade Brigade has no server and no UI. The surface a user touches is the `brigade` CLI, and the only honest way to prove a change is to run that CLI against a target and read what it wrote. This skill drives it through one helper, `control-brigade.py`, so a proof is a rerunnable command instead of a story. Every drive happens in a temp target this skill creates. The helper enforces that: `--target` is accepted only when it resolves *under* `<state-root>/targets`, so the operator home, the Brigade checkout, and every other path are refused before a command runs. The state root gets the same treatment whether it comes from `--root` or from the default - resolved, refused if it resolves to or contains the home directory or the checkout, and refused if it is a symlink at the root or at `targets/`/`captures/`, so a link planted in a world-writable temp dir cannot redirect a drive. `cleanup` removes only paths `new-target` recorded. `AGENTS.md` forbids driving the real workspace anyway; here it is not reachable. What that paragraph does *not* claim: - A path under the temp base is allowed even when `$TMPDIR` sits inside the home directory. That is the only carve-out, and it is exactly that narrow: the home and checkout refusals run *first*, so the allowance applies only when the temp base itself resolves inside the home directory and outside the checkout. A `$TMPDIR` inside the checkout is still refused, and a relative `$TMPDIR` is refused outright rather t