feat(skills,cli): promote-to-prod replay (ADR-0003 capstone) + supplier payment fix

The human-gated path that carries a reviewed sandbox change to prod.

- promote-plan.sh: render a manifest (JSON array of write ops with symbolic @refs
  instead of ids — portable sandbox->prod) as a human-readable change-set.
- promote-apply.sh <manifest> --target sandbox|prod: replay it, resolving each
  @ref to the id actually created during the run (dependent ops wire up). sandbox
  rehearses via dol-write.sh; prod via dol-prod-write.sh.
- dol-prod-write.sh: the ONLY prod-write path. Prod key read from the ENVIRONMENT
  only (DOLIBARR_PROD_WRITE_KEY, never a stored .env); every write refused unless
  ARCO_PROMOTE_CONFIRM=I-UNDERSTAND-THIS-WRITES-PROD.
- create scripts take a DOL_WRITE override so promote-apply reuses them per target.
- bin/arcodange: `promote {plan|apply}` group + example manifest.
- payment-record.sh: fixed supplier payments (payment_mode_id + closepaidinvoices).

Proven live: plan renders; apply --target sandbox replays a 3-op chain with refs
resolved (@tp1->id, invoice socid=@tp1, payment invoice=@inv1); --target prod
without the confirm flag is REFUSED before sending. Supplier payment now works
end-to-end via the script.

Limitation (documented): manifests reference entities they create (@ref);
pre-existing prod entities need business-key resolution (follow-up).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/dolibarr-sandbox-write/scripts/payment-record.sh

@@ -14,7 +14,7 @@
 # Emits the new payment id on stdout.
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-W="${SCRIPT_DIR}/dol-write.sh"
+W="${DOL_WRITE:-${SCRIPT_DIR}/dol-write.sh}"
 
 SRC="${1:-}"
 if [[ -n "${SRC}" && "${SRC}" != "-" ]]; then INPUT="$(cat "${SRC}")"; else INPUT="$(cat)"; fi
@@ -41,7 +41,8 @@ if supplier:
     if d.get("amount") is None:
         sys.exit("payment-record.sh: supplier payments require an 'amount'")
     endpoint = "/supplierinvoices/%s/payments" % inv
-    body = {"datepaye": epoch, "paymentid": mode, "accountid": d["account_id"],
+    body = {"datepaye": epoch, "payment_mode_id": mode, "closepaidinvoices": "yes",
+            "accountid": d["account_id"],
             "amount": str(d["amount"]), "num_payment": d.get("num", ""),
             "comment": d.get("comment", "")}
 else: