feat: add Atomizer HQ multi-agent cluster infrastructure

- 8-agent OpenClaw cluster (Manager, Tech-Lead, Secretary, Auditor,
  Optimizer, Study-Builder, NX-Expert, Webster)
- Orchestration engine: orchestrate.py (sync delegation + handoffs)
- Workflow engine: YAML-defined multi-step pipelines
- Agent workspaces: SOUL.md, AGENTS.md, MEMORY.md per agent
- Shared skills: delegate, orchestrate, atomizer-protocols
- Capability registry (AGENTS_REGISTRY.json)
- Cluster management: cluster.sh, systemd template
- All secrets replaced with env var references

hq/scripts/sync-codex-tokens.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# sync-codex-tokens.sh — Read fresh Codex CLI tokens and propagate to all OpenClaw instances
+# Run after: codex login
+# Can also be called from a cron job or post-login hook
+
+set -euo pipefail
+
+CODEX_AUTH="$HOME/.codex/auth.json"
+OPENCLAW_AGENTS_DIR="$HOME/.openclaw/agents"
+ATOMIZER_AGENTS_DIR="$HOME/.openclaw-atomizer/agents"  # fallback if shared state
+
+if [ ! -f "$CODEX_AUTH" ]; then
+    echo "ERROR: No codex auth.json found at $CODEX_AUTH"
+    echo "Run: codex login"
+    exit 1
+fi
+
+# Check token freshness (< 1 hour old = fresh)
+AGE=$(( $(date +%s) - $(stat -c %Y "$CODEX_AUTH") ))
+if [ "$AGE" -gt 3600 ]; then
+    echo "WARNING: Codex auth.json is ${AGE}s old. Consider running 'codex login' first."
+fi
+
+# Python does the heavy lifting
+python3 << 'PYEOF'
+import json, os, time, sys, glob
+
+codex_path = os.path.expanduser("~/.codex/auth.json")
+with open(codex_path) as f:
+    codex = json.load(f)
+t = codex["tokens"]
+
+new_profile = {
+    "type": "oauth",
+    "provider": "openai-codex",
+    "access": t["access_token"],
+    "refresh": t["refresh_token"],
+    "expires": int(time.time() * 1000) + 10 * 24 * 3600 * 1000,
+    "accountId": t.get("account_id", "")
+}
+
+# Find all auth-profiles.json files
+patterns = [
+    os.path.expanduser("~/.openclaw/agents/*/agent/auth-profiles.json"),
+    os.path.expanduser("~/.openclaw-atomizer/agents/*/agent/auth-profiles.json"),
+]
+
+updated = 0
+for pattern in patterns:
+    for path in glob.glob(pattern):
+        try:
+            with open(path) as f:
+                data = json.load(f)
+            changed = False
+            for key in list(data.get("profiles", {}).keys()):
+                if key.startswith("openai-codex:"):
+                    data["profiles"][key] = new_profile.copy()
+                    changed = True
+            if changed:
+                with open(path, "w") as f:
+                    json.dump(data, f, indent=2)
+                agent = path.split("/agents/")[1].split("/")[0]
+                print(f"  ✓ {agent}")
+                updated += 1
+        except Exception as e:
+            print(f"  ✗ {path}: {e}", file=sys.stderr)
+
+print(f"\nUpdated {updated} agent profiles.")
+PYEOF
+
+# Restart Atomizer cluster if it exists
+CLUSTER="$HOME/atomizer/cluster.sh"
+if [ -f "$CLUSTER" ] && [ "${1:-}" = "--restart" ]; then
+    echo ""
+    echo "Restarting Atomizer cluster..."
+    bash "$CLUSTER" restart
+fi
+
+echo "Done."