feat(deploy): add restricted checkin-bot agent for DMs

- Add checkin-bot agent as default with tools.deny: ["*"]
- Add binding to route admin DM to main agent with full access
- Change dm.policy to "open" so anyone can DM
- Regular users get checkin-bot (no tools), admin gets main agent

deploy/prod/clawdbot.json

@@ -4,6 +4,17 @@
   },
   "agents": {
     "list": [
+      {
+        "id": "checkin-bot",
+        "default": true,
+        "identity": {
+          "name": "tobais",
+          "emoji": "🤖"
+        },
+        "tools": {
+          "deny": ["*"]
+        }
+      },
       {
         "id": "main",
         "identity": {
@@ -21,14 +32,26 @@
       "maxConcurrent": 2
     }
   },
+  "bindings": [
+    {
+      "agentId": "main",
+      "match": {
+        "channel": "discord",
+        "peer": {
+          "kind": "dm",
+          "id": "213199879525105664"
+        }
+      }
+    }
+  ],
   "channels": {
     "discord": {
       "enabled": true,
       "groupPolicy": "allowlist",
       "dm": {
         "enabled": true,
-        "policy": "allowlist",
+        "policy": "open",
-        "allowFrom": ["213199879525105664"]
+        "allowFrom": ["*"]
       },
       "guilds": {
         "884603707658997780": {