fix(agent): gate high-impact tools after untrusted context

[illuzzzio]

Summary

Adds a server-owned authority gate for agent runs that contain untrusted external
context. Once server-marked untrusted context (metadata.trusted=False) enters
a run, unknown tools, MCP tools, and higher-impact actions are blocked before
execution. The restriction is monotonic for the run and is promoted after tool
output, preventing same-batch escalation.

Target branch

• This PR targets dev, not main.

Linked Issue

Part of #4754

Related: #3709

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up or uvicorn app:app) and verified the change works end-to-end.

How to Test

1. Install dependencies and activate the project virtual environment.

2. Run the focused regression tests:

   .\venv\Scripts\python.exe -m pytest tests/test_external_context_tool_gate.py tests/test_tool_policy.py -q
   Expected result: 22 passed.

Verify the changed modules compile:
.\venv\Scripts\python.exe -m py_compile src/tool_capabilities.py src/tool_policy.py src/tool_execution.py src/agent_loop.py

Confirm the tests cover these behaviors:
metadata.trusted=False activates the server-owned authority gate.
Process, filesystem, MCP, and unknown tools are blocked after untrusted context.
A tool result promotes the gate before a later high-impact call in the same model-produced batch.

Full-suite note: pytest -q -x reached 140 passing tests, then stopped because
this Windows environment cannot create symbolic links (WinError 1314) for
test_collect_skill_dir_skips_symlinked_skill_markdown.
Visual / UI changes
Not applicable — this PR changes server-side tool policy only

[RaresKeY]

Closing this in favor of #5817 and the implementation plan tracked in #5815. #5817 already owns this exact scope: the server-owned capability registry, run-local external-context state, same-batch and later-round gating, dispatcher backstop, and focused regression coverage. The later #5818, #5819, and #5821 PRs build on that path.

This implementation also promotes the restriction after every tool result rather than only after context with the relevant provenance, which would over-block normal multi-tool runs, and its safe allowlist includes session metadata that the established capability model treats as private. Keeping a second, conflicting security implementation open would complicate review and ownership, so I’m closing this one in favor of the established series.