fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>

.claude/skills/dolibarr-sandbox-write/SKILL.md

@@ -183,6 +183,9 @@ sandbox KissMetrics on `--target sandbox` and the prod one on `--target prod`.
 - **`banque lire`** (rights id 111) is granted → `scripts/bank-accounts.sh` lists
   accounts (id/label/bank) so a payment can pick its `account_id`. It's in the
   provisioner's `WRITE_IDS`, so a fresh `provisionSandbox.ts` run includes it.
+- **`user lire`** (rights id 251) is granted → the checkpoint *armed* probe
+  (`GET /users/info` in `status`/`relink-env`) answers 200 instead of 403. Also in
+  the provisioner's `WRITE_IDS`.
 - **Avoirs (credit notes)** → `creditnote-create.sh` (customer invoice `type=2`
   referencing `source_invoice`; amounts negative, ref `AVC…`). Supplier avoirs
   are a follow-up.