improve earnings-reviewer agent configs

[Lesego6]

What changed

• Switch transcript-reader model from claude-opus-4-7 to claude-sonnet-4-6 (sufficient for JSON extraction, ~5x cheaper)
• Add temperature, max_tokens, and timeout_seconds to both agents
• Inline orchestrator system prompt (replaces fragile system.file + append pattern)
• Scope FactSet/Daloopa MCP toolsets to named read-only tools only
• Disable write/edit on orchestrator — only note-writer holds Write
• Fix guidance_notes regex to allow ~, +, = characters common in earnings language
• Replace relative skills path (../../../) with ${WORKSPACE_ROOT}-anchored path
• Add explicit note that subagents/model-updater.yaml needs to be created

Why

The original configs had no token budgets, a prompt-injection risk via external system prompt file, and overly broad MCP tool access. See inline YAML comments for details.

Testing

• Deploy to staging with a test ticker
• Confirm transcript-reader schema validation rejects bad output
• Confirm orchestrator cannot call Daloopa write tools