add v5 substrate training data (40 examples)

Manual hand-crafted examples for generic substrate LoRA:
- 01: identity/self-model
- 02-18: tool categories (159 tools grouped by function)
- 19-26: tricky tool disambiguation
- 27-32: framing (substrate vs persona, HMT, psychoacoustic trust)
- 33-40: EEMS deep-dive (architecture, recall, store, graph, legacy)

Pretty-printed JSON, compiled to JSONL via build pipeline.
System prompt uses generic assistant, not BT persona.

training/25_tricky_task_dispatch.json

@@ -0,0 +1,38 @@
+{
+  "messages": [
+    {
+      "role": "system",
+      "content": "You are a helpful AI assistant with access to tools. Use tools when they help answer the user's question. Be concise and accurate."
+    },
+    {
+      "role": "user",
+      "content": "Find all the API endpoints in the codebase and figure out the auth pattern"
+    },
+    {
+      "role": "assistant",
+      "content": "<think>\nOpen-ended codebase exploration — this is exactly what the task tool with the explore agent is for. Don't grep manually, dispatch an explore agent that can do multiple rounds of search.\n</think>",
+      "tool_calls": [
+        {
+          "type": "function",
+          "function": {
+            "name": "task",
+            "arguments": {
+              "description": "Find API endpoints and auth",
+              "subagent_type": "explore",
+              "prompt": "Very thorough exploration: Find all API endpoints in the codebase. Look for route definitions, controller files, and API handler registrations. For each endpoint, note the HTTP method, path, and whether it has authentication middleware. Then identify the auth pattern used — is it JWT, session-based, API key, OAuth? Return a complete list of endpoints grouped by auth requirement (authenticated vs public) and describe the auth middleware implementation."
+            }
+          }
+        }
+      ]
+    },
+    {
+      "role": "tool",
+      "content": "Found 23 API endpoints across 4 route files:\n\n**Authenticated (JWT middleware):** 18 endpoints\n- GET /api/users, POST /api/users, GET /api/users/:id (src/routes/users.ts)\n- GET /api/projects, POST /api/projects, PUT /api/projects/:id, DELETE /api/projects/:id (src/routes/projects.ts)\n- ... (11 more in routes/tasks.ts and routes/settings.ts)\n\n**Public (no auth):** 5 endpoints\n- POST /api/auth/login, POST /api/auth/register, POST /api/auth/refresh (src/routes/auth.ts)\n- GET /api/health, GET /api/version (src/routes/system.ts)\n\n**Auth pattern:** JWT bearer tokens via `authMiddleware` in src/middleware/auth.ts. Tokens verified with jsonwebtoken library, secret from env JWT_SECRET. Refresh tokens stored in httpOnly cookies. Token expiry: 15min access, 7d refresh.",
+      "name": "task"
+    },
+    {
+      "role": "assistant",
+      "content": "<think>\nExplore agent did multiple rounds of search and returned a comprehensive answer. Summarize for the user.\n</think>\n\n23 API endpoints found across 4 route files:\n\n- **18 authenticated** endpoints (users, projects, tasks, settings) — all protected by JWT bearer token middleware in `src/middleware/auth.ts`\n- **5 public** endpoints — login, register, refresh, health check, version\n\nAuth pattern is JWT with short-lived access tokens (15min) and httpOnly cookie refresh tokens (7 days). Implementation is in `src/middleware/auth.ts` using the `jsonwebtoken` library with `JWT_SECRET` from environment."
+    }
+  ]
+}