feat(harness): authority, turn contract, tools, clean_agent_preview

Chat/agent harness work: request-authority model, turn contract, tool
policy/parsing/execution, clean_agent_preview streaming/thinking, ask_user
persistence, session probes, and scheduler.

Source: vendor/photocraft (ad1cff44) harness files, 3-way merged onto
upstream/dev (a8c147b2). Harness core files were independently developed
in both lineages; resolution policy documented in pr_work/C_conflicts.md
(vendor kept where ahead, upstream kept where vendor is behind; full delta
preserved in pr_work/C_upstream_delta.patch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_authority_spec_surface.py

@@ -0,0 +1,42 @@
+"""Spec-surface admission: the strict router picks the tools after authority is
+built, so spec turns admit the router's families; compact/full stay unchanged."""
+import json
+
+from src.agent_runtime.authority import create_request_authority, ExactOperation
+
+
+def _permits(auth, tool, args=None):
+    return auth.permits(ExactOperation.normalize(tool, json.dumps(args or {})))
+
+
+def _auth(text, **kw):
+    return create_request_authority(text, owner="pewds", session_id="s1", workspace="", **kw)
+
+
+def test_spec_surface_admits_a_router_chosen_family_tool():
+    auth = _auth("Search for the appointment email", spec_surface=True)
+    assert _permits(auth, "mcp__email__search_emails", {"action": "list", "query": "appointment"})
+
+
+def test_non_spec_turn_does_not_admit_the_same_call():
+    auth = _auth("Search for the appointment email")
+    assert not _permits(auth, "mcp__email__search_emails", {"action": "list", "query": "appointment"})
+
+
+def test_spec_surface_admits_browser_interaction_and_batch():
+    auth = _auth("do the thing", spec_surface=True)
+    assert _permits(auth, "private_browser", {"action": "batch"})
+    assert _permits(auth, "private_browser", {"action": "click", "selector": "#go"})
+    assert _permits(auth, "private_browser", {"action": "fill", "selector": "#q", "text": "x"})
+
+
+def test_batch_is_read_but_click_stays_verb_gated_off_spec():
+    auth = _auth("search the web for the appointment")
+    assert _permits(auth, "private_browser", {"action": "batch"})
+    assert not _permits(auth, "private_browser", {"action": "click", "selector": "#go"})
+
+
+def test_spec_surface_keeps_the_exact_read_input_seal():
+    auth = _auth("Read note id abc123", spec_surface=True)
+    assert _permits(auth, "manage_notes", {"action": "view", "id": "abc123"})
+    assert not _permits(auth, "manage_notes", {"action": "view", "id": "zzz999"})