Add parent tool progressive disclosure

[Aaronontheweb]

Summary

• Add internal Core and Deferred tool exposure tiers.
• Seed parent sessions with exactly ten core tools.
• Lease discovered first-party and MCP tools without granting invocation authority.
• Filter search, load, suggestions, and server summaries before result limits.
• Hide denied tools without revealing whether hidden names exist.
• Protect complete operator shadow catalogs from agent file and shell access.
• Preserve public registry contracts and legacy catalog behavior.

Stack

• Depends on Add deterministic agent tool contracts #2020.
• This is the second pull request in the agent tool pit-of-success stack.

Deterministic evaluation evidence

• The parent Core snapshot contains 10 tool definitions totaling 10,879 serialized UTF-8 bytes.
• Initial model requests exclude Deferred tool schemas.
• A successful policy-visible load activates one Deferred tool without granting invocation authority.
• Model failure evicts the transient Deferred lease.
• Hidden tools remain absent from exact search, fuzzy suggestions, server summaries, and load responses.
• No hosted behavioral run was used as evidence for this PR.

Validation

• Actors: 3,460 passed; one expected Windows-only skip.
• Security: 1,052 passed.
• Daemon shadow and path checks: 5 passed.
• Strict OpenSpec validation passed.
• Header and no-BOM checks passed.
• Slopwatch reported zero issues.
• Diff checks passed.
• Independent security and API review passed.

[Aaronontheweb]

Sanitized hosted follow-up from the completed top-of-stack rollout proof (#2039): deferred tool discovery passed 5/5. Every trial used search_tools and none used a shell fallback. Raw transcripts and environment details are not published.