V3 authoritative tool catalog implementation plan

For agentic workers: Use superpowers:executing-plans and test-driven-development. Deliver only issue #232; no merge.

Goal: Complete R011, R012, R013, R022 and R023 with the existing ToolRegistry as the authoritative catalog for all 48 runtime tools. Architecture: ToolSpec stores immutable schema/policy/identity metadata and workspace-bound executors. Registry-backed compatibility mappings preserve string invocation and aliases; MCP/provider descriptors, prompts, discovery and docs derive from specs. Security remains the permission authority. Tech stack: Python 3.12/3.13, standard library, existing SDK/test environments; no new dependency or paid calls. Spec: User-approved plan and https://github.com/EvanProgramming/OpenKyrozen/issues/232.

Task 1: Catalog contracts

• [x] Write failing specs/registration/runtime-manifest regressions.
• [x] Extend tools/manifest.py with ToolSpec, ToolManifest projection, validated atomic registration, defensive schema copies and registry-backed mutable compatibility mappings.
• [x] Declare all built-in metadata once in a tool-owned catalog, including canonical identities, aliases, capabilities, side effects, conservative parallel safety and current MCP/string conversions.
• [x] Verify invalid metadata/schema/aliases, duplicate rejection, replacement/removal and snapshot preservation.

Task 2: Runtime and security consumers

• [x] Bind adapter, memory, discovery and orchestration executors per workspace/runtime; preserve child orchestration exclusions and workspace/session isolation.
• [x] Make compatibility AVAILABLE_TOOLS writes register metadata; route dynamic definitions and learning restore through registry.
• [x] Derive capability helpers and aliases from catalog; retain config/token/mode/approval bounds and argument-sensitive checks.
• [x] Build prompts/discovery from spec descriptions and visibility, without adding deferred-discovery behavior assigned to #234.

Task 3: Schemas and documentation

• [x] Move current MCP schema/legacy argument conversion metadata into catalog; preserve existing canonical objects, strings and argument aliases. Typed invocation belongs to #233.
• [x] Generate MCP and provider-neutral descriptors from the same schema; do not serialize provider SDK requests (#229).
• [x] Generate tool inventory from registered specs, retain HTTP route inventory and documentation drift checks.

Task 4: Verify and deliver

• [x] Run focused 3.12/3.13 tests, full suite, make check/lint/docs-check and offline agent/subagent acceptance.
• [x] Obtain independent review; reproduce/fix material findings.
• [ ] GPG-sign task-scoped commits, verify locally/GitHub, create/attach one PR, wait for final-head CI, leave unmerged.

Review focus

• No schema/policy bypass via compatibility dictionary mutation or dynamic registration.
• No shared bound executor across workspaces/users; child callers cannot gain orchestration tools.
• Schema copies/snapshots cannot mutate authoritative metadata.
• Dynamic tools retain restrictive capability and existing source-validation/approval/audit gates.
• Capabilities do not imply side-effect freedom or parallel safety; browser, graph refresh and orchestration remain nonparallel.

Final local verification: 615 full Python3.12 tests,76 focused Python3.13 integration tests; make check/lint/docs-check/agent/subagent acceptance PASS. Independent review findings reproduced and fixed; final review clear. Unsupported schema vocabulary is rejected explicitly; no paid calls.

PR #273 follow-up: reproduced and resolved four automated-review findings. Runtime-tool deletion survives lookup/replacement; mixed-case canonical names and aliases work through plain/XML/DSML calls; valid combinator schemas register while invalid explicit types reject; legacy pipe conversion requires string fields. Final independent re-review reports no material defects. Final local suite and offline acceptance PASS.