Bind agent tool calls to the run's repositories

[ppXD]

Summary

• Agent tool calls now reach only the repositories the run's admitted task bound. This covers agent.run_command, git.fetch_pr_diff, git.list_prs, git.fetch_pr_checks, git.open_pr, git.merge_pr, git.pr_review and git.post_pr_comment.
  • AgentRunExecutor.OpenMcpEndpoint stamps the bound set (id, access, ref) server-side onto AgentRunPosture.
  • NodeAgentTool enforces it once for every node that declares NodeManifest.RepositoryInput.
  • An unbound id gets the same Repository {id} not found. that a missing or foreign id gets.
• Read-only context is read-only:
  • An agent cannot open, merge, review or comment on its pull requests.
  • agent.run_command checks it out only at its bound or default branch (AgentRepositoryBinding).
  • The ref pin covers what a command checks out. The repository's pull requests stay readable through the git read tools.
• A patch-only repository refuses agent pull-request writes through the publish guard chain (IAgentRepositoryPolicy).
• These refusals are answered before an approval-gated call is parked (IAgentTool.RefusalAsync, consulted by McpRequestHandler after the gate's deny check and input validation). Standard and Trusted runs therefore never post a card or claim a ledger row for a call that could only be refused. The tool checks again when the call runs.
• A supervisor-spawned child's related repositories carry the operator's bound ref, not one the supervisor model authored (SupervisorRepoClamp.IntersectWithBoundRepos).
• A run whose write scope is read-only (readOnly on agent.run, or a Confined tier) is served McpCatalogMode.NonDestructive. It gets no tool that writes, but can still ask a human through decision.request.
• Unchanged:
  • The fabric opt-out's ReadOnly slice.
  • Workflow-node calls, which carry no calling run.

Test plan

• Unit: binding, policy and catalog-mode theories; NodeAgentTool against the production PR write nodes (Read, Write and unknown access); handler refusals before park/claim at every tier; supervisor clamp ref; full unit suite (12,417 passed, 1 skipped)
• Integration (Postgres):
  • real MCP dispatch with a second same-team repository
  • every PR write refused on a read-bound repository before the provider
  • read context keeps its PR reads
  • Standard tier with a real approval channel: unbound, read-context, off-branch and patch-only calls are refused at once, with no ledger row and no card
  • the tenant filter is pinned with the foreign id bound
  • the real executor's endpoint: Confined and readOnly runs list decision.request and can reach it, while agent.run_command, git.open_pr and git.merge_pr are absent
  • Agents and Workflows.Supervisor namespaces are green
• E2E: HeadlineFlowE2ETests (readOnly fan-out) 3/3
• Full Workflows integration namespace in CI