fix(harness): ship coherent vendor harness cluster

Rebuild PR C to ship the vendor/photocraft harness as a coherent unit
(vendor implementation + vendor tests) instead of a per-file ahead/behind
mix that produced broken imports and 6+ test failures.

- Flip 36 harness impl/route/test files back to vendor (the per-file
  line-set policy misclassified user-rewritten files as 'behind').
- Flip core/models.py + src/tool_approval_scopes.py to vendor: vendor's
  harness (authority.py, turn_contract.py, clean_agent_preview.py) depends
  on vendor's older approval-scope API; upstream added
  CHAT_SESSION_APPROVAL_SIGNATURE_FIELD that vendor's core/models.py lacks.
- Add src/shutdown.py (new vendor infra) required by routes/chat_routes.py.
- Keep src/agent_tools/__init__.py at upstream (editor_tools registration
  lives in PR B).

Upstream-only security divergence preserved in C_upstream_delta.patch and
flagged for integration-time reconciliation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_aux_llm_owner_scope.py

@@ -49,9 +49,8 @@ def test_scheduler_fallbacks_and_research_headers_are_owner_scoped():
     assert "owner=task.owner or None" in src
     assert "headers_from_resolver = False" in src
     assert "headers_from_resolver = True" in src
-    assert "resolve_owner_registered_endpoint(db2, endpoint_url, task.owner or None)" in src
-    assert "resolve_owner_registered_endpoint(db, endpoint_url, task.owner or None)" in src
-    assert src.count("resolve_endpoint_runtime(ep, owner=task.owner or None)") == 2
+    assert "from src.auth_helpers import owner_filter" in src
+    assert "owner_filter(ep_q, ModelEndpoint, task.owner or None)" in src
 
 
 def test_research_routes_fallbacks_are_owner_scoped():