feat: AI save and save_and_publish tools

[mattbrailsford]

Summary

Stacked on #160 (which itself stacks on #153). Adds two new LLM-visible tools for persisting AI-driven workspace changes:

• save — calls the workspace's requestSubmit(); equivalent to clicking Save. Works on documents and media.
• save_and_publish — calls the document publishing context's saveAndPublish(). Documents only.

The property-value-handler tools introduced in #160 stage changes on the workspace; until now the only way to persist them was a human clicking Save. These tools close that gap so the LLM can complete the staging → persistence flow on the user's behalf.

Design

Both tools route through the entity adapter contract, mirroring the existing applyValueChange shape:

• UaiEntityAdapterApi gains optional save?(ctx) and publish?(ctx) methods returning a new UaiPersistResult { success, error? }.
• UaiEntityAdapterContext gains saveSelectedEntity() / publishSelectedEntity() that delegate to the adapter and produce structured "not supported" errors when an adapter omits a method.

Per-adapter behavior:

Adapter	save	publish
Document	requestSubmit()	resolves UMB_DOCUMENT_PUBLISHING_WORKSPACE_CONTEXT as a sibling and calls saveAndPublish()
Media	requestSubmit() (always live, so save IS publish)	omitted — LLM gets "use save instead"
Block	omitted	omitted — LLM gets "save the parent document"

Two new tool scopes back the tools: entity-save and entity-publish. Both destructive. Split from the existing entity-write so an agent can be granted permission to mutate staged values without also being allowed to commit them, or to save drafts without publishing live.

Permissions migration

Agents currently using AllowedToolScopeIds: ["entity-write"] will not automatically pick these tools up. To enable them, grant the new scopes:

• entity-save for save
• entity-publish for publish (implies save semantics — publishing always saves first)

Agents using explicit AllowedToolIds need:

• Uai.AgentFrontendTool.Save
• Uai.AgentFrontendTool.SaveAndPublish

Test plan

• Existing entity-write tools (set_value, add_item, etc.) continue to work
• save from a document workspace persists staged AI-driven changes
• save from a media workspace persists staged changes
• save from a block workspace returns the structured "save the parent document" error
• save_and_publish from a document workspace publishes the document
• save_and_publish from a media workspace returns "use save instead"
• save_and_publish on a multi-variant document surfaces the variant-picker modal (intentional — same UX as clicking the button)
• An agent without entity-save scope cannot invoke save
• An agent without entity-publish scope cannot invoke save_and_publish

🤖 Generated with Claude Code