fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>

test/provisionSandbox.ts

@@ -39,6 +39,7 @@ import userSetup from "./scripts/admin/userSetup.ts";
     fournisseur:       lire=1181, facture lire=1231, facture creer=1232
     produit:           lire=31,   creer=32
     banque:            lire=111
+    user:              lire=251
 */
 const WRITE_IDS = [
   11, // facture lire
@@ -56,6 +57,9 @@ const WRITE_IDS = [
   31, // produit lire
   32, // produit creer
   111, // banque lire — list bank accounts (GET /bankaccounts) to pick account_id
+  251, // user lire — requis par le probe armé GET /users/info (checkpoint status/relink)
+  //      Sans lui l'endpoint répond 403 alors que la clé authentifie, et le
+  //      checkpoint affiche NOT armed sur un agent pourtant fonctionnel.
 ];
 
 const KEY_FILE = ".ai_agent_sandbox.key";