MANUAL RUN: restart Agent Office as quinnscode-bot (#754 step 2) #819

Part of #754. The bot account and its token are ready, but the office still runs as QuinnsCode. Restarting the office ends every worker's session, so this waits until a moment when no work would be lost.

Steps (owner)

1. Wait until no worker is mid-task: nothing uncommitted, and nothing left unpushed.
2. Stop the office.
3. From apps/agent-office, start it with zsh ~/office-as-bot-754.sh instead of bun run office. That needs Touch ID for op read.
4. Hire a worker on MANUAL RUN: give agents their own GitHub identity, then require review #754.

The worker on #754 then:

• Checks that gh api user --jq .login prints quinnscode-bot. If it still says QuinnsCode, it stops and reports back.
• Opens the PR that sets .github/rulesets/main.json to required_approving_review_count: 1, require_code_owner_review: true and require_last_push_approval: true, so the bot authors it. This PR closes MANUAL RUN: give agents their own GitHub identity, then require review #754.
• After the merge, the owner applies the same settings to the live main ruleset.

Decide before tightening
The bot's classic token has the workflow scope, but #754 asked for no Workflows permission. A fine-grained token can't reach a repo the bot doesn't own. With code-owner review on, a bot PR that edits .github/workflows/* still needs owner approval. Choose one: keep the workflow scope, or reissue the token with repo only.

Details of the script and the credential trace are in Nibble's comment on #754.