fix(templates): use plain KEY=VALUE in BOARD_TOOLS.md.j2

[radicalgeek]

The parse_tools_md() parser uses a regex that expects lines matching ^[A-Z0-9]+=value$ but the template was rendering markdown list items:

• AUTH_TOKEN=value

This mismatch caused sync_gateway_templates() to be unable to read AUTH_TOKEN back from any provisioned workspace, which caused all agents to be skipped on every subsequent template sync (unless rotate_tokens=true).

Fix: render plain KEY=VALUE lines so _parse_tools_md() can parse them.

Also moved role_tag assignment before first use (was at bottom of vars block).

Bug discovered 2026-03-03 during fleet provisioning investigation. Affected all 32 board agents across 9 boards on the dev-team gateway.

Task / context

• Mission Control task:
• Why:

Scope

• <bullet 1>
• <bullet 2>

Out of scope

Evidence / validation

• make check (or explain what you ran instead)
• E2E (if applicable): <cypress run / screenshots>
• Logs/links:

Screenshots (UI changes)

Desktop	Mobile

Docs impact

• No user/operator docs changes required
• Docs updated: <paths/links>

Risk / rollout notes

• Risk level: low / medium / high
• Rollback plan (if needed):

Checklist

• Branch created from origin/master (no unrelated commits)
• PR is focused (one theme)
• No secrets in code/logs/docs
• If API/behavior changes: docs updated (OpenAPI + docs/reference/api.md)

[Copilot]

Pull request overview

Updates the TOOLS.md gateway template output so the backend’s _parse_tools_md() parser can reliably re-read agent runtime settings (notably AUTH_TOKEN) during sync_gateway_templates().

Changes:

• Switch BOARD_TOOLS.md.j2 from markdown list items with backticks to plain KEY=VALUE lines.
• Move role_tag assignment above its first use in the template.
• Add clearer markdown structure around the identity block and notes.

---

You can also share your feedback on Copilot code review. Take the survey.