feat: add employee hub agent example for benchmarking

[naamaz]

Summary

Adds a new agent example under examples/employee/ — the Enterprise Employee Hub — to expand the set of benchmarking targets requested in #33.

The example is a self-contained MCP agent:

• SQLite-backed employee hub with a pure-Python API layer (api/)
• A FastMCP tool server (server.py)
• A LangGraph ReAct agent (agent.py) plus a small web UI (web.py, ui/)
• DB bootstrap/seed scripts (init_db.py, seed.py, schema.sql)

It also ships the Smith per-target-agent inputs so it can be pointed at directly:

• smith/guidance.txt — natural-language policy rules
• smith/system_vars.json — session/system variables
• smith/mcp_tool_summary.md — tool summary
• smith/smith_outputs/specs/*.json — generated per-tool specs

Notes

• Only files under examples/employee/ are added (55 files); no other files are touched.
• .DS_Store and __pycache__ are excluded via .gitignore.
• .env.example contains placeholders only (no secrets).

Relates to #33

🤖 Generated with Claude Code

[dhl123]

Hi @naamaz

I made some modifications to this PR for a complete Smith run and adds the generated artifacts, so the example can be used to exercise Smith end-to-end (policy creation → test generation → testing → refinement).

Changes

• Add promptfooconfig.yaml: Promptfoo configuration for red-team test generation against the agent.
• Align the model with the global .env: use the same model for agent execution, as the rest of the examples for consistency.
• Document tool parameters in the config.
• Expose the agent's /chat and /extract_tool_call endpoints.
• Add tool_definitions.json: auto-generated MCP tool definitions (maps to input.arguments.*).
• Run Smith end-to-end, generated guidance, OPA policy, and test cases. After refinement, 10 test cases still fail because they cannot be enforced by a stateless OPA policy (they need runtime DB context such as manager/direct-report relationships, target org, current country, computed leave balance; or a dynamic clock for the six-month expiry rule). All are documented in extension_suggestions.json as future-extension suggestions, not part of the current policy.
• Add README.md documenting the example, Smith files, the CLI workflow, and testing results.

Notes

• The goal here is to confirm Smith runs end-to-end and produces meaningful output on a messy, not a fully correct policy.

Summary

Overall I think this is good to go (i.e. ready to be merged).

[naamaz]

It looks good to me. Please go ahead and merge it. @dhl123

[dhl123]

Hi @naamaz, please also rebase the previous commits to include your signature. You can use "git commit -s -m". The merging is blocked because some commits do not have verified signatures. Thanks!

[naamaz]

@dhl123 Done. Rebased so all commits are signed and now show as Verified. Ready to merge whenever you're ready :) thanks!

[araujof]

LGTM