Scope host tools to the Codebox transport boundary

[chubes4]

Summary

• Clarifies that HostToolRegistry is a WP Codebox browser/host transport adapter, while Agents API owns canonical tool declarations and result contracts.
• Adds caller-provided canonical client/... declarations to the host tool catalog and maps host tool execution output/errors into an embedded canonical toolResult shape.
• Keeps Codebox-specific validation, policy command, and schema details in a transport diagnostics envelope, and expands the host-tool smoke to prove canonical catalog pass-through plus policy gating.
• Updates the artifact package provenance fixture from 0.3.1 to 0.4.0, matching current package metadata so the artifact contract smoke passes.

Fixes #522.

Verification

• npm run build passed.
• npm run host-tool-registry-smoke passed.
• npm run command-registry-smoke passed.
• npm run sandbox-tool-policy-smoke passed.
• npm run policy-validation-smoke passed.
• npm run external-adapter-contract-smoke passed.
• npm run runtime-episode-smoke passed.
• npm run artifact-contract-smoke passed after updating the stale package provenance fixture.
• git diff --check passed.

Aggregate check note

• npm run check was attempted twice. It exceeded the local tool timeout before completion, first after 30 minutes and then after 60 minutes.
• No assertion failure was reported during the aggregate runs after the package provenance fixture was updated; the directly-run targeted smokes above passed.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Audited the WP Codebox host-tool runtime boundary, drafted and implemented the transport-scoped contract changes, updated smoke coverage, and ran verification commands for Chris to review.