v0.1 wave 3 (steps 9+10): autonomous patch loop + production recipes

Step 9 — autonomous patch loop:
- patcher.py: clawdforge session → unified diff → worktree apply → verify recipe → push branch → open Gitea PR
- migration 007: patch_attempts (UNIQUE per finding+attempt, max 3 attempts)
- runner.py: post-parse hook fires patcher.maybe_draft_for_job when notify.auto_patch=true
- server.py: POST /jobs/{id}/patches, GET /patches, GET /patches/{id}
- digest.py: patch-drafted lines + open-follow-up count via Gitea PR state check
- mcp: crafting_table_draft_patch stub replaced with real implementation
- tests/test_patcher.py + tests/test_patches_api.py: 27 new tests

No auto-merge — patches stop at PR-open. Cobb merges.

Step 10 — production recipes:
- examples/recipes/clawdforge.json: 14 subprojects across all SDKs, audit nightly
- examples/recipes/cauldron.json: single Flask subproject, audit nightly
- examples/recipes/tradecraft.json: nightly audit, auto_patch=false (manual review)
- examples/register-all.sh: bulk-register helper with GITEA_TOKEN substitution
- README "Autonomous patch loop" + "First production recipes" sections

Tests: server 116→143, mcp 65→67. All green.

Spec: memory/spec-crafting-table.md

.env.example

@@ -42,3 +42,14 @@ CRAFTING_GC_AGE=86400
 # CRAFTING_SMTP_PASS=
 # CRAFTING_SMTP_FROM=crafting-table@sulkta.com
 # CRAFTING_SMTP_TLS=1
+
+# --- Autonomous patch loop (wave 3, optional) ------------------------------
+# All four CRAFTING_CLAWDFORGE_* + CRAFTING_GITEA_* must be set for the
+# patcher to come up. Missing any → patcher disabled, /jobs/{id}/patches
+# returns 503. Runner hook silently no-ops.
+# CRAFTING_CLAWDFORGE_URL=http://192.168.0.5:8800
+# CRAFTING_CLAWDFORGE_TOKEN=cf_...
+# CRAFTING_GITEA_URL=http://192.168.0.5:3001
+# CRAFTING_GITEA_TOKEN=
+# CRAFTING_PATCHER_MAX_ATTEMPTS=3
+# CRAFTING_PATCHER_BRANCH_PREFIX=crafting-table/auto/