Add RICE system prompt and rewrite onboarding agent

[karthikedula]

@

What changed

• Rewrote system_prompt.md using the RICE structure (Role, Intent, Context, Enforcement).
• Rewrote agent.py around that prompt: ReAct loop, tool registry, retry/escalation, and audit-safe logging.
• Added an offline mode (--offline) with a deterministic mock brain so the workflow runs without an API key.
• Load secrets from a git-ignored .env with a secure prompt fallback.
• Fixed observation truncation that had corrupted the provisioned access_profile.

Testing

• python agent.py --dry-run passes.
• python agent.py --employee EMP-2026-0847 --offline completes the full workflow end to end.
• Live LLM run (Groq) completes and provisions the full, correct access_profile.

🤖 Generated with Claude Code
@