feat(brief): add standing CodeGraph usage contract to ship and scout scaffolds

[pruge]

What

Adds a standing CodeGraph usage contract to the crewmate/scout brief scaffold in bin/fm-brief.sh, so every firstmate-spawned worker uses CodeGraph consistently across all projects.

The new # CodeGraph usage contract section appears in both ship and scout scaffolds (not secondmate charters) with five points:

1. At task start: codegraph status in the worktree; codegraph init if .codegraph/ is absent, codegraph sync if present.
2. Structure questions (call paths, blast radius, symbol lookup) go through codegraph explore|node|callers|callees|impact instead of grep.
3. Run codegraph sync after each edit batch - the index does not follow edits and silently goes stale; a stale No results found is NOT proof code is absent.
4. Before reporting done, run codegraph affected on changed files to select which tests to run.
5. Learning loop: append discovered query patterns, keywords, and per-area symbol maps to the project's docs/agents/codegraph/README.md (created lazily), keeping an AGENTS.md pointer via bin/fm-ensure-agents-md.sh.

The section never assumes codegraph is installed: when the binary is missing, the worker appends a one-line status note and continues with ordinary tools.

Scope

• bin/fm-brief.sh: shared section builder (printf-based, Bash 3.2 parse-safe, guarded by the existing structural test), rendered into ship and scout heredocs.
• tests/fm-brief.test.sh: new test_codegraph_contract_in_ship_and_scout_briefs covering all five points on both variants plus the absent-binary note and the charter exclusion.
• Docs needed no changes: no doc embeds the brief shape verbatim (verified by grep).

Out of scope per task: MCP server installation, fm-spawn/fm-control changes, per-project AGENTS.md edits.

Verification

• bash tests/fm-brief.test.sh: all pass including the new test.
• bin/fm-lint.sh: shellcheck 0.11.0 clean, actionlint clean.
• bin/fm-doc-audience-check.sh: ok.
• Consumer-family tests (fm-secondmate-safety, fm-tangle-guard, fm-subagent-pretool-check, fm-ask-user-authority) pass. tests/fm-voice-relay.test.sh has one pre-existing failure ("note should not need any configuration", sed error on a temp path) that reproduces identically on the clean base branch, unrelated to this change.