Migrate agent tables to network scope (base_prefix)

[chubes4]

Summary

Agent identity, tokens, and access grants are now shared across the multisite network using $wpdb->base_prefix, following the same pattern WordPress uses for wp_users and wp_usermeta.

Agents are an abstraction of users — they must live at the same scope. One user identity, one agent identity, per-site capabilities.

Changes

• BaseRepository — new get_table_prefix() method (defaults to $wpdb->prefix, overridable by child classes)
• Agents, AgentTokens, AgentAccess — override to use $wpdb->base_prefix
• New site_scope column on datamachine_agents — optional blog_id for site-focused agents (NULL = network-wide)
• Migration — consolidates per-site agent rows into network table with slug-based dedup, preserves access grants and tokens
• Activation hooks — agent tables created once at network level via datamachine_create_network_agent_tables()
• Fixed 4 raw $wpdb->prefix references in AgentAbilities.php and migrations.php

Per-site tables (flows, pipelines, jobs, chat sessions) are completely unaffected.

Architecture

Network level (base_prefix)         Per-site (prefix)
───────────────────────────         ─────────────────
c8c_datamachine_agents              c8c_7_datamachine_flows
c8c_datamachine_agent_tokens        c8c_7_datamachine_pipelines
c8c_datamachine_agent_access        c8c_7_datamachine_jobs

Mirrors WordPress core: wp_users (network) + wp_N_posts (per-site).

Testing

Tested on production multisite (11 sites):

• ✅ Migration consolidated 4 agents from 4 sites into network table
• ✅ site_scope correctly set per originating blog_id
• ✅ Access grants preserved (3 grants for studio agent)
• ✅ Slug dedup worked (wire site's chubes skipped, events chubes migrated)
• ✅ Cross-site queries work — events site sees all 4 network agents
• ✅ Per-site tables (flows, pipelines) still use site-specific prefix
• ✅ get_table_prefix() override only affects agent repos, not others

Context

Enables the Sarai Chinwag external agent test case — a single bearer token will authenticate across any site in the network. Also unblocks network-activating Data Machine in the future.