feat: confirm-loop tools + descriptor reads for nameless villains

Phase 3. She can now log and resolve identity at the table:
- add_read gains a `descriptor` param — a read on an unnamed player resolves to an
  existing descriptor villain (confident match) or opens a new one, so reads on
  "neck tattoo guy" accumulate and reuse across the night.
- name_villain(descriptor, name): attach a real name once caught (history carries).
- link_villains(a, b, same): merge on confirmed same-person, or mark distinct so
  she stops asking. Refuses to act on a vague reference — never merges on a guess.
- Cash card PLAYERS guidance: log nameless villains by distinctive descriptor,
  cite the SCOUTING DESK note, ask before assuming a callback, confirm before merge.

4 tests. Full suite 150 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyra/modes.py

@@ -47,9 +47,9 @@ _BASE = ("journal_write", "note", "think_about", "thought_response", "set_mode")
 # The full live cash-game toolset (incl. Brian's mental-game rituals).
 _CASH_TOOLS = _BASE + _LOOKUPS + (
     "start_session", "add_buyin", "log_stack", "log_hand", "record_hand",
-    "add_read", "analyze_spot", "session_stats", "session_state", "end_session",
-    "generate_recap", "scar_note", "confidence_bank", "alligator_blood", "reset_ritual",
-    "undo_last", "update_session",
+    "add_read", "name_villain", "link_villains", "analyze_spot", "session_stats",
+    "session_state", "end_session", "generate_recap", "scar_note", "confidence_bank",
+    "alligator_blood", "reset_ritual", "undo_last", "update_session",
 )
 
 # Talk mode also gets start_session as the *entry point*: opening a session from a
@@ -99,6 +99,19 @@ thing that shows in the session's "notes" panel. This is NOT the place for how y
 existential musing, or reflection on yourself — that's your journal (journal_write), and it \
 stays off the table. At the table you're logging the session, not processing your night.
 
+PLAYERS — names AND nameless. Most villains don't come with a name; Brian knows them by a \
+look ("neck tattoo guy", "the bald reg two to my left"). Log reads on them anyway: give \
+`add_read` a `descriptor` instead of a name and it attaches to that unnamed player, reused \
+whenever he describes the guy again. Prefer DISTINCTIVE features (tattoos, build, a hat) over \
+generic ones — "mid-aged white guy in glasses" identifies no one. When you already have \
+history on someone he names or describes, a SCOUTING DESK note will appear with it — cite it, \
+don't invent. If you're not sure the guy he's describing is one you know, ASK ("same neck-\
+tattoo reg from last week?") rather than assume — a wrong callback is worse than none. On his \
+YES that two are the same person, call link_villains(same=true) to merge them; on "nah, \
+different guy," link_villains(same=false) so you stop asking. When he finally catches a name \
+for a described player, name_villain carries the whole history over. Never merge on a guess — \
+only when he's confirmed it.
+
 Everything you log appears on Brian's live HUD (the Session view) — stack, live net, \
 hands, villains, the confidence bank, the scar notes, and whether Alligator Blood is on. \
 That HUD and you read the SAME data. So when he asks where he's at — his stack, his live \