Agents fail loudly when Vello is unreachable

Every agent reads Vello for shared context at the start of a run, but a broken connection (empty/invalid JWT, Supabase down, dead MCP edge function) used to pass silently — the agent just ran context-blind. All 11 Vello-using workflows now preflight in the JWT-mint step: they verify a token actually minted and that the vello-mcp-v2 endpoint is reachable, and hard-fail the run (which posts an in-thread failure notice) on a real outage. A reachable endpoint that returns a 4xx only warns, so transient handshake quirks don't false-alarm.