feat(write-skill): client-dossier ops — thirdparty update (allowlisted) + idempotent contacts

Part of erp#65 (phase 1). Ledger grammar "thirdparty complete" gets its
op: allowlisted non-ledger fields, per-field diff read-back. Contacts
are born idempotent (dedupe by email then name). Promote ops wired both
targets, offline stub tests, SKILL.md workflows, KM dossier manifest
(unsigned-contract truth fix + EIN-to-collect note).

Co-Authored-By: Claude Fable 5 <[email protected]>

.claude/skills/dolibarr-sandbox-write/scripts/promote-plan.sh

@@ -35,6 +35,16 @@ for i, op in enumerate(ops, 1):
         print("       invoice=%s mode=%s account=%s %s%s" % (inp.get("invoice_id"), inp.get("mode", "VIR"),
               inp.get("account_id"), ("amount=%s" % inp["amount"]) if inp.get("amount") else "(full)",
               (" tx=%s" % txid) if txid else " tx=MISSING"))
+    elif t == "thirdparty_update":
+        flds = inp.get("fields") or {}
+        print("       socid=%s update %d dossier field(s): %s" % (inp.get("socid"), len(flds),
+              ", ".join(sorted(flds)) if flds else "NONE (will be refused)"))
+    elif t == "contact":
+        name = " ".join(x for x in (inp.get("firstname"), inp.get("lastname")) if x) or "?"
+        print("       socid=%s contact %s%s%s (idempotent: dedupe by email, then lastname+firstname)"
+              % (inp.get("socid"), name,
+                 (" — %s" % inp["poste"]) if inp.get("poste") else "",
+                 (" <%s>" % inp["email"]) if inp.get("email") else ""))
 print("\nNext:")
 print("  promote-apply.sh <manifest> --target sandbox   # rehearse the replay (safe)")
 print("  promote-apply.sh <manifest> --target prod      # WRITES PROD — needs DOLIBARR_PROD_WRITE_KEY")