fix(harness): ship coherent vendor harness cluster

Rebuild PR C to ship the vendor/photocraft harness as a coherent unit
(vendor implementation + vendor tests) instead of a per-file ahead/behind
mix that produced broken imports and 6+ test failures.

- Flip 36 harness impl/route/test files back to vendor (the per-file
  line-set policy misclassified user-rewritten files as 'behind').
- Flip core/models.py + src/tool_approval_scopes.py to vendor: vendor's
  harness (authority.py, turn_contract.py, clean_agent_preview.py) depends
  on vendor's older approval-scope API; upstream added
  CHAT_SESSION_APPROVAL_SIGNATURE_FIELD that vendor's core/models.py lacks.
- Add src/shutdown.py (new vendor infra) required by routes/chat_routes.py.
- Keep src/agent_tools/__init__.py at upstream (editor_tools registration
  lives in PR B).

Upstream-only security divergence preserved in C_upstream_delta.patch and
flagged for integration-time reconciliation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_execution_bridge.py

@@ -1,6 +1,4 @@
 import asyncio
-import json
-import pytest
 import logging
 import src.tool_execution as tool_execution
 from tests.runtime_evidence_helpers import server_authorized_executor
@@ -17,60 +15,6 @@ from src.tool_execution import (
 execute_tool_block = server_authorized_executor(execute_tool_block)
 
 
-@pytest.mark.parametrize("content", ['{"path":"/workspace/x"}', '{"path":"/workspace/x","content":null}',
-                                   '/workspace/x', '/workspace/x\n', '/workspace/x\n \t',
-                                   json.dumps({'path': '/workspace/x.py', 'content': '```python\n\n```'})])
-def test_bridge_refuses_missing_or_ambiguous_empty_content(monkeypatch, tmp_path, content):
-    async def forbidden(*args, **kwargs):
-        raise AssertionError("ambiguous write reached remote producer")
-    monkeypatch.setattr(tool_execution, "_client_bridge", lambda context: {"url": "http://bridge", "token": "x"})
-    monkeypatch.setattr(tool_execution, "_bridge_post", forbidden)
-    async def invoke():
-        token = tool_execution._active_workspace.set(str(tmp_path))
-        try:
-            return await tool_execution._route_tool_via_bridge("write_file", content, "s", {})
-        finally:
-            tool_execution._active_workspace.reset(token)
-    _, result = asyncio.run(invoke())
-    assert result["exit_code"] == 1
-    assert "content" in result["error"] or "JSON" in result["error"]
-
-
-@pytest.mark.parametrize("body", ["", " \t", "normal source"])
-def test_bridge_honors_explicit_json_string_content(monkeypatch, tmp_path, body):
-    import base64
-    seen = []
-    async def post(bridge, endpoint, payload, **kwargs):
-        seen.append((endpoint, base64.b64decode(payload["content_b64"])))
-        return {"output": "written", "exit_code": 0}
-    monkeypatch.setattr(tool_execution, "_client_bridge", lambda context: {"url": "http://bridge", "token": "x"})
-    monkeypatch.setattr(tool_execution, "_bridge_post", post)
-    async def invoke():
-        token = tool_execution._active_workspace.set(str(tmp_path))
-        try:
-            return await tool_execution._route_tool_via_bridge("write_file", json.dumps({"path": "/workspace/x", "content": body}), "s", {})
-        finally:
-            tool_execution._active_workspace.reset(token)
-    _, result = asyncio.run(invoke())
-    assert result["exit_code"] == 0
-    assert seen == [("/write", body.encode())]
-
-
-@pytest.mark.parametrize("content", ['/workspace/x\n', '{"path":"/workspace/x"}', '/workspace/x\n \t'])
-def test_scoped_bridge_cannot_blindly_write_implicit_empty(content):
-    async def forbidden(*args):
-        raise AssertionError("scoped bridge received an ambiguous destructive write")
-    bridge = AgentExecutionBridge(forbidden, frozenset({'write_file'}), 'empty-intent-test')
-    async def invoke():
-        with bind_execution_bridge(bridge):
-            block = Block(content)
-            block.tool_type = 'write_file'
-            return await execute_tool_block(block, security_context=NO_TOOL_SECURITY_CONTEXT)
-    _, result = asyncio.run(invoke())
-    assert result['exit_code'] == 1
-    assert 'content' in result['error']
-
-
 class Block:
     tool_type = "host_shell"
 
@@ -215,7 +159,7 @@ def test_scoped_execution_bridge_failure_logs_compact_warning(caplog) -> None:
     assert "Scoped execution bridge test-environment failed for tool=host_shell" in caplog.text
 
 
-def test_tui_bridge_write_file_rejects_text_for_binary_artifact(monkeypatch, tmp_path) -> None:
+def test_tui_bridge_write_file_rejects_text_for_binary_artifact(monkeypatch) -> None:
     """The bridge path must preserve rendered media just like local writes."""
     called = False
 
@@ -228,17 +172,12 @@ def test_tui_bridge_write_file_rejects_text_for_binary_artifact(monkeypatch, tmp
     monkeypatch.setattr(tool_execution, "_bridge_post", fake_post)
 
     async def invoke():
-        token = tool_execution._active_workspace.set(str(tmp_path))
-        try:
-            return await tool_execution._route_tool_via_bridge(
-                "write_file",
-                '{"path":"/tmp_workspace/results/screenshot.png","content":"The screenshot is complete."}',
-                "run-1",
-                {"surface": "odysseus-tui"},
-            )
-
-        finally:
-            tool_execution._active_workspace.reset(token)
+        return await tool_execution._route_tool_via_bridge(
+            "write_file",
+            '{"path":"/tmp_workspace/results/screenshot.png","content":"The screenshot is complete."}',
+            "run-1",
+            {"surface": "odysseus-tui"},
+        )
 
     description, result = asyncio.run(invoke())