feat(agent-tools): add model-callable workspace workflow

[Qiyuanqiii]

Summary

• add the versioned agent-code-tools.v1 registry and exact Code/Plan/Deliver/root/Profile capability matrix
• expose bounded workspace_list, workspace_read, workspace_glob, and workspace_grep tools with stable pagination, UTF-8/binary/ignore/hidden/link/casing/root checks, redaction, and Workspace-bound cursors
• add reviewed patch/create/move/delete workflows with exact source/destination hashes, separate deletion confirmation, durable approvals, no-clobber create/move, recoverable move state, and os.Root-confined mutations
• persist Go-issued authority snapshots and normalized results/refusals across multi-round Supervisor recovery, charge tool budgets, and capture bounded Artifacts
• surface tool source, generation, availability, and refusal reasons through CLI, HTTP/OpenAPI, and Desktop; add schema v115 after context-continuity schema v114, migration coverage, ADR 0116, and bilingual docs
• improve provider qualification diagnostics when streamed tool calling is unavailable

Security boundaries

The model receives schemas and arguments only; it cannot mint the Go-issued authority attached after provider decoding. Execution revalidates Run, Mission, Session, Workspace, root identity, root Agent, mode/profile/permission revisions, active lease, Policy, approval, and content hashes. Plan remains read-only; Review/Learn remain read-only; Cyber and Specialist receive no agent-code tools. This grants no Shell, Git, network, browser, Sandbox, or package-install authority.

Portable replacement re-hashes immediately before an atomic root-handle rename. A non-cooperating local writer can still race that final content-CAS window, but cannot redirect the mutation outside the opened Workspace; the residual is documented in ADR 0116 and Project Status.

Validation

• go test -p 2 ./... -count=1 -timeout=30m
• go test ./internal/store -count=1 -timeout=20m
• targeted post-audit agent-code, CLI, restart, Artifact, move/delete, and migration tests
• go test -race ./internal/workspace ./internal/fileedit ./internal/toolgateway -count=1
• go test -race ./internal/application -run 'TestAgentCode|TestRunSupervisor.*AgentCode' -count=1
• agent-code payload fuzzing (over 1.1 million executions in the final run)
• Linux/amd64 cross-compilation for workspace and FileEdit packages with CGO disabled
• go vet ./...
• npm run typecheck, 60 frontend test files / 246 tests, and npm run build
• npm run check:api
• git diff --check and credential-shaped diff scan

Closes #99