fix(harness): ship coherent vendor harness cluster

Rebuild PR C to ship the vendor/photocraft harness as a coherent unit
(vendor implementation + vendor tests) instead of a per-file ahead/behind
mix that produced broken imports and 6+ test failures.

- Flip 36 harness impl/route/test files back to vendor (the per-file
  line-set policy misclassified user-rewritten files as 'behind').
- Flip core/models.py + src/tool_approval_scopes.py to vendor: vendor's
  harness (authority.py, turn_contract.py, clean_agent_preview.py) depends
  on vendor's older approval-scope API; upstream added
  CHAT_SESSION_APPROVAL_SIGNATURE_FIELD that vendor's core/models.py lacks.
- Add src/shutdown.py (new vendor infra) required by routes/chat_routes.py.
- Keep src/agent_tools/__init__.py at upstream (editor_tools registration
  lives in PR B).

Upstream-only security divergence preserved in C_upstream_delta.patch and
flagged for integration-time reconciliation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/agent_runtime/resources.py

@@ -114,9 +114,11 @@ def _control_plane_snapshot():
     uploader = get_upload_handler()
     if uploader is not None and isinstance(getattr(uploader, "upload_dir", None), (str, os.PathLike)):
         protected.add(canonical_root(Path(uploader.upload_dir) / "uploads.json"))
-    # Prefix protection covers the complete runtime trees. Public policy denies
-    # every regular hardlink alias, so collecting all child inodes here would
-    # add an unbounded recursive state inventory without widening protection.
+    for directory in job_dirs:
+        jobs = Path(directory)
+        if jobs.exists():
+            # Uninspectable state fails closed; hardlinks retain object identity.
+            protected.update(canonical_root(p) for p in jobs.rglob("*") if p.is_file())
     protected.update(canonical_root(getattr(constants, name) + suffix)
                      for name in ("APP_DB", "SCHEDULED_EMAILS_DB", "EMAIL_CACHE_DB")
                      for suffix in ("-wal", "-shm", "-journal"))
@@ -129,7 +131,7 @@ def _control_plane_snapshot():
         except FileNotFoundError:
             continue
         identities.add((observed.st_dev, observed.st_ino))
-    # Effect directories are protected by prefix without inventorying children.
+    # Effect directories join the prefix set only after the recursive inventory.
     return frozenset(job_dirs | effect_dirs), frozenset(protected), frozenset(identities)
 
 
@@ -137,11 +139,6 @@ def _control_plane_path(path, *, snapshot=None):
     # A scan-local snapshot bounds repeated hardlink checks. Ordinary resource
     # resolution always observes fresh state. Neither form is an atomic kernel
     # access policy, and snapshots must never survive a workspace guard call.
-    # Public state and hardlink denial also applies to sealed resources. Lazy
-    # import avoids coupling inert identity definitions to dispatcher startup.
-    from src.tool_execution import _is_app_state_path, _is_hardlinked_regular_file
-    if _is_sensitive_path(path) or _is_app_state_path(path) or _is_hardlinked_regular_file(path):
-        return True
     directories, protected, identities = _control_plane_snapshot() if snapshot is None else snapshot
     if any(Path(path).is_relative_to(directory) for directory in directories) or path in protected:
         return True