feat(fleet): scaffold the atom registry — classes, contract, worked example, AGENTS.md section

Closes erp#38 deliverables: fleet/ layout, atom.yaml schema documented
in fleet/README.md, 7 class skeletons per the PRD agent-catalog,
invoice-extract as the worked example (contract only — implementation
is erp#40), golden/ + profile/ stubs, AGENTS.md Fleet section with
freshness fixes (fleet/ no longer "not yet landed").

Co-Authored-By: Claude Fable 5 <[email protected]>

fleet/classes/deterministic-controller.md

@@ -0,0 +1,37 @@
+# Deterministic controller — class skeleton
+
+> Per the PRD [agent catalog](https://gitea.arcodange.lab/arcodange-org/factory/src/branch/main/vibe/PRD/ai-back-office/agent-catalog.md#agent-classes):
+> deliberately **LLM-free** — a cron-driven script with validators is the best
+> "agent" for deterministic work.
+
+## Mission
+
+Deterministic work deserves deterministic agents: scheduled scripts + validators +
+linters with **no LLM at all**. This skeleton documents the posture, not a prompt —
+there is none; the catalog's prompt/code column names a script.
+
+## Tool posture
+
+- Cron-driven scripts (k3s CronJobs) over read-only skills, or gate-bound writers
+  fed by matched data (never free text).
+- No model call anywhere in the loop.
+
+## Typical I/O shape
+
+Typed feeds (bank APIs, ERP reads, calendar files, backup metadata) → typed
+findings (matched / bank-only / dolibarr-only buckets, drift alerts, freshness
+reports, deadline reminders).
+
+## Escalation
+
+Every anomaly becomes a digest/queue item for a human or the owning atom —
+controllers flag, they do not fix. Every standing loop heartbeats: **silence is
+an alert** (a missing report is a failure, not a quiet day).
+
+## Invariants
+
+- Same input ⇒ same output; every check is replayable.
+- Read-only by default; any side effect rides the same gates as everyone else.
+- Zero unexplained deltas is a standing bar, not a one-off test.
+
+Serves: T07, T08-matched, T11, T13, T14. Model: none. Orchestrator: k3s CronJobs.