test(agent): controlled fixture KB + one-command fast loop for tool-calling iterations

The phase-72 iteration loop cleared the database, git-cloned the homelab repo, re-imported 38-51 documents and re-embedded per run — many minutes per iteration against a different KB every time (owner directive 2026-09-04: stop importing the homelab repo on every test run). Replace it with:

- tests/fixtures/agent_kb/: 8 hand-written markdown docs (sources 'deployments'/'homelab') whose specifics (rack7, 10.77.42.0/24, VLAN 130, rbm-8842, 17 2 * * *, obsidian-bor:2026.7.14, 18765, 18443, ...) no model can guess; read targets carry non-topical filenames so their questions do not lexically seed them (the read must actually happen)
- tests/fixtures/test_kb.dump.sql: data-only snapshot (TRUNCATE + INSERTs incl. embeddings, self-contained git_sources rows, static KB overview) — verified by round-trip checksum at build time
- scripts/load_test_kb.py: one-off rebuild (real pipeline + embeddings, ~2s) that also prints the per-question retrieval report (all 10 battery questions must be grounded)
- scripts/restore_test_kb.py: sub-second one-transaction restore (no git clone, no re-embedding)
- scripts/agent_realmodel_check.py: the gate gains --restore / --mode fixture (curated 10-question battery with one unambiguously correct tool behavior per question) / --turns N (12s micro-loop) / --concurrency / per-turn + total wall timing, and a second accuracy metric (contract accuracy: well-formed calls targeting resolvable entities) alongside the phase-72 locked executed ratio — the re-read of a seeded doc is a copy-invariant model behavior (5 variants, 0/15 flipped) that the dedupe refusal counts as a failure
- TOOL_CALLING_TESTING.md: the human-readable methodology (fast loop, design rules, metrics, copy levers + tried-and-reverted table, current standing, open design question)

Measured: restore 0.03s; micro-loop ~12s; full loop ~43-55s; concurrency 2/3 gives no gain (endpoint serializes).

tests/fixtures/agent_kb/homelab/networking/vela-bridges.md

@@ -0,0 +1,18 @@
+# Rack7 Proxmox Cluster
+
+Three-node Proxmox VE cluster on the rack7 shelf: `pbx-node1`, `pbx-node2`
+and `pbx-node3`, all running PVE 8.3.4 (build `8.3.4-1-lab1`).
+
+## Virtual interfaces
+
+| vmbr  | purpose             | config                                             |
+|-------|---------------------|----------------------------------------------------|
+| vmbr0 | management          | 10.77.42.0/24, gateway 10.77.42.1 on pbx-node1     |
+| vmbr1 | lab (VLAN 42)       | tag 42, no DHCP, NAT-only to the uplink            |
+| vmbr2 | lab-iot (VLAN 130)  | tag 130, DHCP served by minio01                    |
+
+- Cluster firewall is enabled on every node; VLAN 42 traffic is NAT-only.
+- Corosync heartbeat rides vmbr0; keep the management iface out of the
+  lab-iot VLAN.
+- Node roles: pbx-node1 = hypervisor + gateway, pbx-node2 = AIO
+  containers, pbx-node3 = GPU box.