feat(R05): tool capability registry, unified policy gateway, MCP lifecycle manager

EPIC R05 (Team Hoa) - one security/approval path for every tool call.

R05-T01 domain/tools/{tool_descriptor,tool_registry}.py
  ToolCapability (READ/WRITE/EXECUTE/NETWORK, composable) + ToolDescriptor +
  ToolRegistry, replacing three independently-maintained gating lists
  (core/tools.py::WRITE_TOOLS, code_agent.py's WRITE_TOOLS|MS365_WRITE_TOOLS,
  chat_agent.py's literal ("run_command","install_package") tuple) with one
  capability lookup.

R05-T02 infrastructure/filesystem/{file_tools,command_tools,fetch_tools,tool_context}.py
  core/tools.py's execute_tool if/elif chain split into per-concern modules.
  core/tools.py is now a strangler-fig shim: re-exports ToolContext/ToolError,
  dispatches through a {name: handler} dict built from the split modules.
  core/tools.py: 566 -> 291 lines.

R05-T03 application/conversations/tool_policy_gateway.py
  ToolPolicyGateway.allow(name, gate, payload) - capability-driven ALLOW vs
  ask-the-gate decision. Wired into both chat_agent.py::run_cowork and
  code_agent.py::run_code, replacing their separate hand-rolled checks.
  Verified equivalent to the old hardcoded sets by test.

R05-T04 (behavior change, not just refactor)
  MCP/connector tools (core/mcp_client.py, core/ext_connectors.py) reached
  chat_agent.py via extra_executor(name, args) with NO permission check at
  all. They are now tagged with a conservative default capability
  (WRITE|EXECUTE|NETWORK - no MCP tool self-declares risk) and routed through
  the SAME ToolPolicyGateway as built-ins. When "confirm before running
  commands" is on, MCP/connector calls now prompt like run_command already
  did - a real gap closed, and a user-visible change worth calling out.

R05-T05 infrastructure/mcp/mcp_source_manager.py
  McpToolSourceManager extracts the connection cache/lock/start-or-skip
  lifecycle out of state.py::AppContext (_mcp_connections/_conn_lock) into a
  standalone, directly-testable class. AppContext.build_mcp_tools and
  _ms365_builtin_connection now call ensure()/stop(); _ext_connections
  (unified Connectors) is out of scope for this task and keeps its own lock.

New tests: tests/unit/test_tool_registry_and_policy.py,
test_code_agent_tool_policy.py, test_cowork_extra_tool_policy.py,
test_mcp_source_manager.py (26 new tests).

Suite: 254 passed, 4 pre-existing failures unrelated to R05 (2 EPIC R02
config-security, 2 environment-dependent routing tests - see checklist).
check_imports: PASS. All new files < 400 LOC.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_cowork_extra_tool_policy.py

@@ -0,0 +1,86 @@
+"""EPIC R05-T04: before this change, ``core/chat_agent.py::run_cowork`` called
+``extra_executor(name, args)`` directly for any MCP/connector tool — no
+permission check at all, regardless of the "confirm before running commands"
+setting. This pins the fix: an extra tool now goes through the same
+``ToolPolicyGateway`` as ``run_command``, using the conservative default
+capability (``UNKNOWN_SOURCE_CAPABILITIES``) since MCP tools carry no
+standard risk metadata.
+
+Runs the real engine via :class:`FakeProvider`, matching
+``tests/characterization/test_run_cowork.py``'s approach.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+from cowork_local.core.chat_agent import run_cowork
+from cowork_local.providers.base import ToolSpec
+from tests.fakes import FakeProvider, ScriptedTurn
+
+
+class _RecordingGate:
+    def __init__(self, approve: bool):
+        self.approve = approve
+        self.calls: List[Dict[str, Any]] = []
+
+    def request(self, payload: Dict[str, Any]) -> bool:
+        self.calls.append(payload)
+        return self.approve
+
+
+_EXTRA_SPEC = ToolSpec(name="github__delete_repo", description="", parameters={"type": "object"})
+
+
+def _run(tmp_path, provider, gate, executed: List[str]):
+    events: List[Dict[str, Any]] = []
+    messages: List[Dict[str, Any]] = [{"role": "user", "content": "hi"}]
+
+    def extra_executor(name: str, args: Dict[str, Any]) -> Dict[str, Any]:
+        executed.append(name)
+        return {"ok": True, "output": "done"}
+
+    run_cowork(provider, messages, tmp_path, events.append, gate=gate,
+              extra_tools=[_EXTRA_SPEC], extra_executor=extra_executor)
+    return events
+
+
+def test_mcp_style_tool_is_rejected_without_ever_calling_the_executor(tmp_path):
+    provider = FakeProvider([
+        ScriptedTurn(tool_calls=[("github__delete_repo", {})]),
+        ScriptedTurn(text="done"),
+    ])
+    gate = _RecordingGate(approve=False)
+    executed: List[str] = []
+    events = _run(tmp_path, provider, gate, executed)
+
+    assert len(gate.calls) == 1 and gate.calls[0]["name"] == "github__delete_repo"
+    assert executed == []  # rejected BEFORE the extra_executor ever ran
+    results = [e for e in events if e.get("type") == "tool_result"]
+    assert results[0]["ok"] is False
+
+
+def test_mcp_style_tool_runs_once_approved(tmp_path):
+    provider = FakeProvider([
+        ScriptedTurn(tool_calls=[("github__delete_repo", {})]),
+        ScriptedTurn(text="done"),
+    ])
+    gate = _RecordingGate(approve=True)
+    executed: List[str] = []
+    events = _run(tmp_path, provider, gate, executed)
+
+    assert executed == ["github__delete_repo"]
+    results = [e for e in events if e.get("type") == "tool_result"]
+    assert results[0]["ok"] is True
+
+
+def test_no_gate_preserves_auto_run_for_extra_tools(tmp_path):
+    """``gate=None`` is Cowork's existing "no confirmation configured" state —
+    must still auto-run, exactly like before this EPIC."""
+    provider = FakeProvider([
+        ScriptedTurn(tool_calls=[("github__delete_repo", {})]),
+        ScriptedTurn(text="done"),
+    ])
+    executed: List[str] = []
+    events = _run(tmp_path, provider, None, executed)
+
+    assert executed == ["github__delete_repo"]