Agent key setting: changes by this agent always need review #323

Decision 3 of #309: forcing a proposal works per call (propose: true in item_store, done in #315) and as a setting on the agent key in the web app. The key setting was split off from #315 on 2026-09-19 and runs after the switch (#317).

Work

• AgentKey.RequireReview (migration), set when creating or editing a key on the Agents & keys page, shown there.
• Carried into the principal and Actor, so ProposalService.MustReview returns true for every shared memory, page and instructions change of that key, also for a moderator's key.
• project_get reports it, for example as reviewRequired: true next to the permissions, so an agent knows its changes become proposals.
• System guide and /connect mention the setting.

Acceptance

• A moderator key with the setting gets proposed from item_store where the same key without it gets published.
• Tasks stay unreviewed; the setting does not affect them.
• Existing keys keep today's behaviour (the column defaults to false).