feat(agents): harden picker ranking, pruning, and status chips - #60

Rank file-lister/file-picker programmatically and emit set_output instead of an LLM mock path. Keep discovery-linked constraints ahead of file-picker facts, spawn context-pruner in threshold e2e via spawn_agent_inline, hide healthy index chips behind overflow-aware status-bar selection, and accept spawn_agent_inline on dynamic-agent templates.

The selectStatusBarChips shrink ladder could exit while the chip cluster still exceeded the width budget. With a warning or error index chip present, the ladder ran out of steps after dropping cost, model, git, and context, so the cluster measured 18 against a budget of 17 and the test-cli overflow test failed in CI.

Add a last-resort step that drops the timer even during an active run, after the context-drop step. The index chip is never dropped or relabeled by that step, so an index alert still survives the narrowest rows.

Follow-up hardening from review: export shared statusBarClusterWidth, statusBarChipBudget, and STOP_BUTTON_WIDTH so tests reuse the production width math instead of duplicating it; name the budget constants; truncate model names by stringWidth on grapheme cluster boundaries; drop an index chip that would clamp to an uninformative ellipsis-only label; and derive the context label from a single source shared with the overflow-shorten step.

Expand status-bar-chips coverage: tone thresholds, sub-cent, zero, and negative cost, zero-diff git and deletions, xs timer, stop-hint, and non-error index paths, active versus idle timer priority, budget invariants, and wide-character and ZWJ truncation. 48 pass / 0 fail locally, typecheck green.

createBase2 no longer takes progressiveToolDisclosure; base2 always ships the full mode-resolved surface and the only narrowing control is the new optional unlockedTiers option. It pins progressiveToolDisclosure: false and publishes fullToolSurface from the default all-tier resolve, so stale persisted unlockedToolTiers cannot narrow a resumed surface.

Tier constants and the UnlockedToolTier type now live solely in packages/agent-runtime/src/util/base2-tool-tiers.ts and the template derives its surface from them, removing FULL_SURFACE_ORDER and the duplicated list that had to stay in sync.

filterByUnlockedTiers now requires an explicit ceiling (a predicate or the new ALLOW_ALL_TIER_TOOLS sentinel) so a caller with no ceiling can no longer fail open into allow-all, and getEffectiveAgentToolNames fails closed when programmaticConfig.fullToolSurface is absent.

Also drops the inert OPENBUFF_PROGRESSIVE_PROMPT_DISCLOSURE and OPENBUFF_PROGRESSIVE_TOOL_DISCLOSURE env canaries and the docs advertising them.

Unify skipIfMissing description and deletion-only validation across str_replace and edit_transaction schemas so provider and input surfaces cannot drift and both reject non-empty newString cleanly.

Add structured anchor_scope_mismatch and capability_scope failureKind handling, anchored candidate line offsets, bounded occurrence walks, and ordering fixes that report idempotent cleanup as no-op skips instead of scope mismatches or large-file blocks. Harden the str_replace handler with shared circuit-breaker guidance, centralized failure-budget accounting, structured errorCode/recovery payloads, and an all-skip zero-patch guard so mixed batches preserve real changes while fully-skipped cleanups succeed without file writes.

The schema commit b124f29 added the skipIfMissing doc comment for idempotent deletion replacements. Regenerate the four tool-definition sources via generate-tool-definitions so the CI 'Check generated tool definitions are current' step passes.

A failed str_replace under a context_compacted re-read marker left the sticky whole-file read authorization intact, so a later write_file could overwrite the file from a hash the model can no longer observe. The failure path now re-marks the path as requiring a fresh read while markEditRequiresFreshRead preserves the original context_compacted reason and sourceTool instead of downgrading it. This fixes the failing agent-runtime read_files edit-state recovery test.

Also hardens the handler: empty-but-valid files are authorized by the auto-re-read gate instead of failing closed on an unhashable-content check, the structuralRecovery failure budget is released on the failure path and not only after a successful apply, stale content is no longer reused for auto-re-read when recovering from a failed edit, and untyped result casts are replaced with a typed StrReplaceResultWithMetadata intersection. Adds circuit-breaker tests for failed-recovery budget release and empty-file auto-re-read authorization, and makes the unreachable client stub throw so an accidental call fails the test.