A profile is committed and its roles travel with it, but a type written only
into the project that declares it cannot be named from another checkout or a
cloud session. `orchestrate agent` now also points the user's own agents folder
at each generated file.

A LINK, never a copy. A copy is one fact in two places, and the first edit to a
role makes them disagree with nothing to say which is current — the failure this
package spends its time removing everywhere else.

SESSION-PREFIXED, which is the part that turns it from convenience into
correctness. That folder is shared by every session on the machine while a role
name is chosen per project, so two sessions publishing a `reviewer` would land
on one name and the second would silently win. Third instance of that shape in
one build: refs/stash shared by nine worktrees, a scratchpad shared by every
lane, and now this — each a namespace addressed by a name that looks unique,
with no error when two writers meet, and every one caught by luck rather than by
a failure.

`orchestrate cleanup` sweeps this session's links and leaves every other
session's standing, so the folder does not accumulate every role every project
ever declared.

SkillLink now stands for a file as well as a directory, rather than a second
linker being written beside it — same symlink-with-copy fallback, so the
platforms it already handles are handled here.