fix(harness): ship coherent vendor harness cluster

Rebuild PR C to ship the vendor/photocraft harness as a coherent unit
(vendor implementation + vendor tests) instead of a per-file ahead/behind
mix that produced broken imports and 6+ test failures.

- Flip 36 harness impl/route/test files back to vendor (the per-file
  line-set policy misclassified user-rewritten files as 'behind').
- Flip core/models.py + src/tool_approval_scopes.py to vendor: vendor's
  harness (authority.py, turn_contract.py, clean_agent_preview.py) depends
  on vendor's older approval-scope API; upstream added
  CHAT_SESSION_APPROVAL_SIGNATURE_FIELD that vendor's core/models.py lacks.
- Add src/shutdown.py (new vendor infra) required by routes/chat_routes.py.
- Keep src/agent_tools/__init__.py at upstream (editor_tools registration
  lives in PR B).

Upstream-only security divergence preserved in C_upstream_delta.patch and
flagged for integration-time reconciliation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_tool_path_confinement.py

@@ -169,14 +169,12 @@ def test_blocks_netrc():
         _resolve_tool_path("~/.netrc")
 
 
-def test_allows_agent_workspace(tmp_path):
-    """Paths under the agent's workspace in project data/ must resolve
-    cleanly. The rest of data/ is application state and is rejected;
-    tests/test_agent_state_dir_confinement.py covers that side."""
+def test_allows_project_data(tmp_path):
+    """Paths under project data/ must resolve cleanly."""
     from src.tool_execution import _resolve_tool_path
-    from src.constants import AGENT_WORKSPACE_DIR
-    target = os.path.join(AGENT_WORKSPACE_DIR, "test-confinement-ok.txt")
-    os.makedirs(AGENT_WORKSPACE_DIR, exist_ok=True)
+    from src.constants import DATA_DIR
+    target = os.path.join(DATA_DIR, "test-confinement-ok.txt")
+    os.makedirs(DATA_DIR, exist_ok=True)
     with open(target, "w") as f:
         f.write("ok")
     try:
@@ -315,8 +313,8 @@ async def test_write_file_dispatch_rejects_empty_directory_like_workspace_path(m
         workspace=str(tmp_path),
         security_context=NO_TOOL_SECURITY_CONTEXT,
     )
-    assert "BLOCKED" in desc
-    assert "content required; missing content section" in (
+    assert desc == "write_file: /workspace/papers"
+    assert "content required; refusing to create an empty file" in (
         result.get("error") or ""
     )
     assert result.get("exit_code") == 1