Add scoped runtime tool source

[chubes4]

Summary

• Adds a run-scoped runtime tool source for client/transport-declared tool definitions using the Agents API declaration contract.
• Keeps runtime tools denied by default unless explicitly named by allow_only or an allow-mode tool policy, then lets the existing Agents API policy pass continue filtering.
• Marks runtime tools as client/external executor tools and refuses server-side PHP execution for them instead of adding a fake executor path.

Refs #1485. This is the declaration/policy slice only; client/transport callback fulfillment is tracked in #2205.

Testing

• php tests/tool-source-registry-smoke.php
• php tests/runtime-tool-declaration-smoke.php
• php tests/pipeline-tool-policy-snapshot-smoke.php
• php tests/ai-completion-assertion-packet-smoke.php
• php tests/upsert-handler-result-handoff-smoke.php
• php tests/adjacent-handler-tool-policy-smoke.php
• php tests/agent-conversation-runner-request-smoke.php
• vendor/bin/phpcs inc/Api/Chat/ChatOrchestrator.php inc/Engine/AI/Tools/ToolExecutor.php inc/Engine/AI/Tools/ToolPolicyResolver.php inc/Engine/AI/Tools/ToolSourceRegistry.php inc/Engine/AI/Tools/Sources/RuntimeToolSource.php tests/adjacent-handler-tool-policy-smoke.php tests/ai-completion-assertion-packet-smoke.php tests/pipeline-tool-policy-snapshot-smoke.php tests/tool-source-registry-smoke.php tests/upsert-handler-result-handoff-smoke.php
• vendor/bin/phpcs tests/tool-source-registry-smoke.php

Follow-up

• Implement client runtime tool callback fulfillment #2205 implements the run-event/client callback fulfillment path so allowed executor=client tools can return tool results without PHP execution.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: implementing and testing the focused Support scoped client-declared runtime tools #1485 runtime tool source slice; Chris remains responsible for review.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
Deep dive: homeboy lint data-machine --changed-since 9caa8a9

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-lint-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-lint-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26334711300

Test

✅ test — passed

• 834 passed

ℹ️ Auto-fix lint issues: homeboy refactor data-machine --from lint --write
ℹ️ Collect coverage: homeboy test data-machine --coverage
ℹ️ Save test baseline: homeboy test data-machine --baseline
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test data-machine --changed-since 9caa8a9

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-test-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-test-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26334711300

Audit

✅ audit — passed

• dead_code — 187 finding(s)
• requested_detectors — 133 finding(s)
• intra-method-duplication — 74 finding(s)
• repeated_literal_shape — 13 finding(s)
• field_patterns — 9 finding(s)
• parallel-implementation — 8 finding(s)
• structural — 6 finding(s)
• Taxonomy — 5 finding(s)
• Abilities — 4 finding(s)
• Flow — 4 finding(s)
• Total: 456 finding(s)

Deep dive: homeboy audit data-machine --changed-since 9caa8a9

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-audit-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-audit-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26334711300

Tooling versions

• Homeboy CLI: homeboy 0.197.2+718b1d1a
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: dd23ee80
• Action: unknown@unknown