feat(viking): restrict access to configured URI prefixes

[Million-mo]

Summary

Adds allowed_uri_prefixes to VikingCapabilityConfig, an opt-in URI prefix allowlist that scopes all Viking access to configured viking:// prefixes.

Previously an agent with the Viking capability could access every resource under the whole viking:// namespace — there was no way to grant read access to a single subtree (e.g. viking://resources/wiki/) without also exposing viking://resources/raw/, viking://user/*/memories/, etc.

Empty list (the default) preserves the current unrestricted behavior — fully backward compatible.

What changes

When allowed_uri_prefixes is non-empty:

Layer	Behavior
All 15 viking_* tools	Reject URIs outside the allowed prefixes (error string returned, SDK call not made)
viking_search / viking_find	With no target_uri, automatically scope to the first allowed prefix; with a target_uri outside the allowlist — reject
list_resources() / read_resource() / resource_exists()	@-mention flow only surfaces resources under the allowed prefixes; out-of-scope reads return None/False
Auto recall / profile injection	Skipped when the memories URI is outside the allowlist
Compaction / multimodal-bridge uploads	Skipped when the archive/upload URI is outside the allowlist
Skills discovery	list_skills/read_skill/skill_exists return empty/false when the skills URI is out of scope
System prompt	Documents the restriction and tells the model not to guess paths

Usage

agents:
  wiki_agent:
    capabilities:
      - type: viking
        mode: retrieve
        allowed_uri_prefixes:
          - "viking://resources/wiki/"
        uri_guard_enabled: true

Files changed

• src/wolfharness_config/capabilities.py — new allowed_uri_prefixes field
• src/wolfharness/capabilities/viking/__init__.py — _check_uri_allowed() + _allowed_prefix_for() helpers; guards on ResourceAccess, skills, auto-recall, profile, compaction, uploads
• src/wolfharness/capabilities/viking/tools.py — prefix check in all 15 tools
• src/wolfharness/capabilities/viking/instructions.py — access-restriction guidance
• tests/capabilities/viking/test_viking.py — 20 new L1 unit tests
• tests/capabilities/viking/test_viking_integration.py — 5 new L2 integration tests
• changelog/unreleased/2026-08-18-viking-allowed-uri-prefixes.md

Validation

• ruff check + ruff format clean
• mypy clean on changed sources
• pytest tests/capabilities/viking/ → 483 passed (458 pre-existing + 25 new)
• pytest tests/capabilities/ → 1324 passed (no cross-module regressions)