feat: WIRE 17 SDLC agents into orchestrate + Mac bulk ingest helper

USER 1: 'BD/SA/QA/agent ไม่ได้ทำงานเลยดิ' — true!
roster.json had 17 agents defined but NEVER wired into orchestrate.
Every stage just used generic LLM ladder, no specialist routing.

FIX: surrogate-orchestrate.sh now LOADS roster.json + INJECTS system prompt:
- get_agent_system_prompt(role) reads from agents/roster.json
- Each call_agent() prefixes prompt with role's system prompt
- DEV stage routes to SPECIALIST via detect_dev_specialist():
task contains 'react/vue/css' → dev-frontend
task contains 'ios/android/flutter' → dev-mobile
task contains 'sql/schema' → dev-database
task contains 'api/backend/server' → dev-backend
task contains 'docker/k8s/terraform' → devops-engineer
task contains 'sre/slo/incident' → sre-engineer
task contains 'security/cve/vuln' → devsecops-engineer
task contains 'data/etl/airflow' → data-engineer
task contains 'ml/training/lora' → ml-engineer
else → dev-fullstack
- Stage 1 SA uses solution-architect prompt (DDD + patterns + risks)
- Stage 2 architect uses tech-architect prompt (file plan + signatures)
- Stage 3 QA-TDD uses qa-engineer prompt
- Stage 4 DEV routes to specialist (NEW)
- Stage 5 QA-verify uses qa-engineer + perf + security
- Stage 6 Reviewer uses reviewer prompt (final gate)

Result: Each orchestrate cycle uses 6 different specialist agents (not all
generic). Output quality matches the role's actual expertise.

USER 2: 'Day-1 เอามาเยอะที่สุด' — HF Space 1-CPU is bottleneck.
Mac M3 24GB = 10 cores. Can run 8 shards there.

NEW: ~/.local/bin/mac-bulk-ingest.sh
- 8 shards spawn locally on Mac M3
- Each pulls 1/8 of DATASETS, streams + dedups via central store
- Periodic upload to HF dataset
- mac-bulk-ingest start | stop | status

Throughput when Mac shards added:
HF Space 8 shards: ~800K/h (network-bound)
Mac M3 8 shards: ~3M/h (10-core, faster network)
Combined: ~4M/h (5x current)

Day-1 with both: ~50-80M (vs 15-20M HF-only)

User opts in by running: bash ~/.local/bin/mac-bulk-ingest.sh start
WARNING: fan will be loud. Stop anytime with 'mac-bulk-ingest.sh stop'.

bin/surrogate-orchestrate.sh

@@ -90,12 +90,67 @@ $(head -c 6000 "$prd_file")
     fi
 done
 
-# ── Helper: call LLM directly (skip surrogate -p agent loop entirely) ──
-# Why: agent loop forces tool-use system prompt → models output tool-call attempts
-# instead of clean markdown deliverables. Direct LLM call gives reliable text-in/text-out.
+# ── Load 17 SDLC agent roster (system prompts per role) ──────────────────
+# agents/roster.json defines 17 specialist agents — they were descriptive only.
+# Now WIRED: each orchestrate stage uses the relevant agent's system prompt.
+ROSTER_PATH="$HOME/.surrogate/agents/roster.json"
+
+get_agent_system_prompt() {
+    local role="$1"
+    [[ ! -f "$ROSTER_PATH" ]] && return
+    python3 -c "
+import json, sys
+try:
+    r = json.load(open('$ROSTER_PATH'))
+    print(r.get('agents',{}).get('$role',{}).get('system',''))
+except: pass
+"
+}
+
+# DEV stage routing — pick specialist based on task keywords
+detect_dev_specialist() {
+    local task_lower="${1,,}"
+    if echo "$task_lower" | grep -qE "react|vue|next|svelte|tailwind|css|html|frontend|ui|component|wcag"; then
+        echo "dev-frontend"
+    elif echo "$task_lower" | grep -qE "ios|swift|android|kotlin|react.native|flutter|mobile|app store"; then
+        echo "dev-mobile"
+    elif echo "$task_lower" | grep -qE "sql|postgres|mysql|schema|migration|index|explain|query|database"; then
+        echo "dev-database"
+    elif echo "$task_lower" | grep -qE "api|rest|graphql|grpc|backend|server|endpoint|fastapi|express|gin|axum"; then
+        echo "dev-backend"
+    elif echo "$task_lower" | grep -qE "data|etl|airflow|spark|kafka|dbt|pipeline"; then
+        echo "data-engineer"
+    elif echo "$task_lower" | grep -qE "ml|model|training|inference|lora|fine-tune|rag|embedding"; then
+        echo "ml-engineer"
+    elif echo "$task_lower" | grep -qE "docker|kubernetes|k8s|helm|terraform|cloudformation|deploy"; then
+        echo "devops-engineer"
+    elif echo "$task_lower" | grep -qE "incident|postmortem|sre|slo|sli|observability|monitoring"; then
+        echo "sre-engineer"
+    elif echo "$task_lower" | grep -qE "security|cve|vuln|sast|dast|owasp|penetration"; then
+        echo "devsecops-engineer"
+    else
+        echo "dev-fullstack"
+    fi
+}
+
+# ── Helper: call LLM directly with ROLE-SPECIFIC system prompt ──
 call_agent() {
     local role="$1" prompt="$2" output_file="$3"
-    echo "${CY}▶${R} ${B}$role${R} ${D}working...${R}"
+    # If DEV role, route to specialist based on task
+    local effective_role="$role"
+    if [[ "$role" == "dev" ]]; then
+        effective_role=$(detect_dev_specialist "$TASK")
+        echo "${CY}▶${R} ${B}$role${R} ${D}→ specialist: ${YE}$effective_role${R}"
+    else
+        echo "${CY}▶${R} ${B}$role${R} ${D}working...${R}"
+    fi
+    # Load specialist system prompt from roster
+    local agent_system
+    agent_system=$(get_agent_system_prompt "$effective_role")
+    if [[ -z "$agent_system" ]]; then
+        # Fallback for stages with non-roster names
+        agent_system="You are a senior $effective_role. Apply best practices. Output deliverable directly."
+    fi
 
     local prior_artifacts=""
     if [[ -d "$WORKDIR" ]]; then
@@ -105,7 +160,11 @@ call_agent() {
     # Write prompt to temp file (avoids bash quoting hell with multi-KB prompts)
     local prompt_file="$WORKDIR/.prompt-${role//[^a-zA-Z0-9]/_}.txt"
     cat > "$prompt_file" <<EOF
-ROLE: $role
+=== AGENT SYSTEM PROMPT (from roster: $effective_role) ===
+$agent_system
+=== END SYSTEM ===
+
+ROLE TASK ($role):
 
 $prompt
 ${RESEARCH_CONTEXT}