office: populate the agent identity in the mount + runtime reads TPS_IDENTITY_DIR; supervisor exit status when an agent dies at launch (cli#352 r3 follow-ups) #355

Follow-ups from cli#352 round 3 (the office supervisor under nono), neither a gate on #352:

1. Office identity is never populated in the container. office.ts writes only team.json under the mount root; the key-creating paths (tps agent create, tps branch, tps identity init) write into the operator's host $HOME/.tps/identity, never into the bind mount. So the supervisor's grant <state root>/identity/<id>.key (= /workspace/.tps/identity/<id>.key) points at a file that does not exist, the ℹ️ path fires, and the office agent cannot sign as its id. Also, since r3 the launched agent's HOME is its own account home (/home/<user>, writable, ungranted — required for nono's state root), so the runtime's $HOME/.tps/identity/<id>.key is a different path from the granted one. Fix shape: office creation populates <branch office>/<team id>/.tps/identity/<id>.{key,pub} (the same mount that carries team.json), and the runtime reads the identity dir from the launch (TPS_IDENTITY_DIR set by the supervisor to <state root>/identity) rather than from HOME. Acceptance: an office agent signs a mail as its roster id; a fixture with the file missing shows the ℹ️ line and the agent runs unsigned (degraded, not unsafe).
2. The supervisor exits 0 when a launched agent dies immediately. r3's image-level control caught the HOME defect only because the marker never appeared; before it, "every office agent silently failed to start" while the supervisor returned 0. The supervisor should propagate a non-zero exit (or a restart policy with a bounded crash loop) when an agent exits non-zero within its first N seconds, and the image-level step should assert the supervisor's exit status as well as the marker.
3. Carried: test-tps-office-supervisor.sh's workflow-invocation guard is a fixed-string grep that a commented-out line satisfies (same shape as cli#353 item 5).

Refs #341 #352.