initial: identity resolution plugin

- Plugin manifest (plugin.yaml) with pre_gateway_dispatch + on_session_start hooks
- /identity slash command for config management
- Honcho injector patch docs (6 lines in plugins/memory/honcho/__init__.py)
- Config file at /opt/data/identity-config.json for persistence
- Kanban task body convention: context_peer: <name>
- Sample config with thierry/catherine mappings

Architecture: user-installed plugin (hooks + CLI) + 6-line Honcho bundled plugin change

docs/enforcement.md

@@ -0,0 +1,35 @@
+# Enforcing context_peer in the kanban-worker skill
+
+Profiles (Claire, Ashley, Finn, Matt) must include `context_peer: <name>` in
+every `kanban_create` call. This document covers how to enforce it.
+
+## Option 1: Profile system prompt (recommended, no code change)
+
+Add to each profile's system prompt or skill config:
+
+> When creating a kanban task with `kanban_create`, you MUST include
+> a `context_peer: <name>` metadata block in the task body. The peer
+> must be the intended user's Honcho peer name (e.g., `thierry`,
+> `catherine`), not your own profile name.
+>
+> Format:
+> ```metadata
+> context_peer: thierry
+> ```
+
+## Option 2: kanban-create wrapper tool
+
+Create a custom tool in `/opt/data/hermes-tools/` that wraps `kanban_create`
+and rejects calls without `context_peer` in the body.
+
+This approach requires the persistent tools volume (already used for QET,
+Gitea, Ollama tools) and a tool registration in the Docker entrypoint.
+
+## Option 3: Slash command validation
+
+The `/identity` command includes a `validate` subcommand that checks recent
+kanban tasks for missing `context_peer` fields.
+
+```bash
+/identity validate
+```