skaldsong: align env-var contract with app reality (pre-first-deploy)

skaldsong-dev surfaced three contract corrections before the first
deploy:

- WORLDTREE_TOKEN (outbound HTTP Bearer) was missing — separate code
  path from SKALDSONG_BIFROST_JWT_KEY (inbound HS256 verify) but
  same secret value.
- WORLDTREE_BASE_URL replaces SKALDSONG_WORLDTREE_API_URL (the
  former is what the app actually reads).
- SKALDSONG_HOST_WIZARD_AGENT_ID was missing entirely — must pin to
  skaldsong:wizard-v2 to inherit the existing Worldtree agent slot;
  blank would burn another slot of the 50-per-key Heimdall quota.

stacks/skaldsong/.env.example

@@ -39,9 +39,17 @@ SKALDSONG_BIFROST_JWT_KEY=
 # Coordinated update with worldtree-dev required if host:port changes.
 SKALDSONG_HOST_BIFROST_ENDPOINT_URL=http://10.250.50.70:8300
 
-# URL skaldsong uses to call Worldtree's conversation API. From
+# Worldtree API client — outbound. Same Bearer as
-# ana-docker, corviduo-dev's IP:port LAN-direct.
+# SKALDSONG_BIFROST_JWT_KEY (different code path consumes it).
-SKALDSONG_WORLDTREE_API_URL=http://10.250.50.152:8080
+WORLDTREE_TOKEN=
+WORLDTREE_BASE_URL=http://10.250.50.152:8080
+
+# Wizard agent ID on Worldtree. MUST be pinned to the existing slot
+# (skaldsong:wizard-v2) — blank would POST /agents/define and burn a
+# slot of the 50-agent-per-key quota. Heimdall scopes agent_id to
+# user_id, so this matches the agent defined from skaldsong-dev's
+# prior nh3-dev hand-launch.
+SKALDSONG_HOST_WIZARD_AGENT_ID=skaldsong:wizard-v2
 
 # CORS — comma-separated origins. Include the SPA's public hostname AND
 # any dev origins still in rotation.

stacks/skaldsong/README.md

@@ -85,9 +85,11 @@ scripts/elway ana-docker --playbook playbooks/deploy-skaldsong.yaml \
 | `SKALDSONG_BIND` | ✓ | ✓ | Host bind address (0.0.0.0 default). |
 | `SKALDSONG_DB_DIR` | ✓ (mount) | ✓ | Host path for SQLite. |
 | `SKALDSONG_RUNS_DIR_HOST` | ✓ (mount) | ✓ | Host path for generation artifacts. |
-| `SKALDSONG_BIFROST_JWT_KEY` | ✓ (anchor) | ✓ | Shared HS256 secret w/ Worldtree's `WORLDTREE_SKALDSONG_USER_KEY`. |
+| `SKALDSONG_BIFROST_JWT_KEY` | ✓ (anchor) | ✓ | Shared HS256 secret w/ Worldtree's `WORLDTREE_SKALDSONG_USER_KEY`. Same value as `WORLDTREE_TOKEN`. |
 | `SKALDSONG_HOST_BIFROST_ENDPOINT_URL` | ✓ (anchor) | ✓ | URL Worldtree calls back to (must match allowlist). |
-| `SKALDSONG_WORLDTREE_API_URL` | ✓ (anchor) | ✓ | URL skaldsong calls Worldtree at. |
+| `WORLDTREE_TOKEN` | ✓ (anchor) | ✓ | Bearer for outbound HTTP to Worldtree. Same value as `SKALDSONG_BIFROST_JWT_KEY`. |
+| `WORLDTREE_BASE_URL` | ✓ (anchor) | ✓ | URL skaldsong calls Worldtree at. |
+| `SKALDSONG_HOST_WIZARD_AGENT_ID` | ✓ (anchor) | ✓ | Existing agent slot ID (`skaldsong:wizard-v2`). Blank burns a Heimdall quota slot on first boot. |
 | `SKALDSONG_HOST_CORS_ORIGINS` | ✓ (anchor) | ✓ | Comma-separated CORS origins. |
 | `SKALDSONG_TTS_ENGINE` | ✓ (anchor) | ✓ | `kokoro` (only engine in v1). |
 | `SKALDSONG_TTS_BASE_URL` | ✓ (anchor) | ✓ | Kokoro URL (WG-routed). |

stacks/skaldsong/compose.yaml

@@ -47,9 +47,22 @@ services:
       # required if host:port changes.
       SKALDSONG_HOST_BIFROST_ENDPOINT_URL: "${SKALDSONG_HOST_BIFROST_ENDPOINT_URL:-}"
 
-      # URL skaldsong uses to call Worldtree's conversation API. From
+      # Worldtree API client. WORLDTREE_TOKEN is the SAME shared-secret
-      # ana-docker, this is corviduo-dev's IP:port LAN-direct.
+      # Bearer as SKALDSONG_BIFROST_JWT_KEY above — different code path
-      SKALDSONG_WORLDTREE_API_URL: "${SKALDSONG_WORLDTREE_API_URL:-http://10.250.50.152:8080}"
+      # consumes it (outbound HTTP Authorization header vs inbound HS256
+      # JWT verify). WORLDTREE_BASE_URL is corviduo-dev's IP:port
+      # LAN-direct from ana-docker.
+      WORLDTREE_TOKEN: "${WORLDTREE_TOKEN:-}"
+      WORLDTREE_BASE_URL: "${WORLDTREE_BASE_URL:-http://10.250.50.152:8080}"
+
+      # Wizard agent ID on Worldtree. MUST be pinned to the existing
+      # agent slot (`skaldsong:wizard-v2` per skaldsong-dev's prior
+      # hand-launched setup); leaving blank on first boot would POST
+      # /agents/define and burn another slot of the 50-agent-per-key
+      # Heimdall quota. Heimdall scopes agent_id to user_id, so the
+      # ana-docker deployment inherits the same id as the nh3-dev
+      # hand-launch.
+      SKALDSONG_HOST_WIZARD_AGENT_ID: "${SKALDSONG_HOST_WIZARD_AGENT_ID:-skaldsong:wizard-v2}"
 
       # CORS for the SPA. Comma-separated origins; include both the
       # public hostname and any dev origins still in rotation.