fix: recognise a read whose verb is at the end of the name

[hyoshi]

From a post-merge review of #569. The defect is older than #569, but #569 is where it first produced a wrong answer an operator can see, and its author pinned it with a KNOWN DEFECT test that specifies the fix and predicts which assertion flips.

This PR was rewritten after review. The first attempt loosened the shared is_read_only_tool_name; a review defeated its guard and blocked the merge. That critique was correct and this describes the design it forced.

The defect

mureo's tools put the verb LAST (google_ads_campaigns_list); the shared read vocabulary matched a verb FIRST only (list_campaigns, the bridged convention). So a native read reached the rollback planner as a write with no reversible_params hint and was classified IRREVERSIBLE. A batch containing one showed the operator a read among the items they "cannot revert", and reported partial coverage for a change set that was in fact fully revertible.

The direction was safe. What it cost was trust in the surface #549 exists to provide.

Why this is a second predicate rather than a wider one

is_read_only_tool_name is unchanged. A new reads_as_a_report_only_action also accepts a trailing verb, and the rollback planner is its only caller.

The shared predicate has three other callers, and every one decides something about plugin tools, whose names mureo does not choose:

caller	what it decides
server._register_plugin_pattern_fallbacks	skips the guardrail money pattern-scan — a denial
plugin_semantics.derive_semantics	whether a call is promoted into action_log at all
policy.learning_reset	whether a change can restart a learning period

Widening the shared rule widens all three at once. The first attempt guarded that with a hand-written verb list; the review defeated it by taking a real installed naming family and swapping the verb:

yahoo_ads_patch_placement_url_list       -> read (wrong)
yahoo_ads_cancel_placement_url_list      -> read (wrong)
yahoo_ads_duplicate_placement_url_list   -> read (wrong)
yahoo_ads_attach_placement_url_list      -> read (wrong)

Each would have silently lost its ## Guardrails cap. No hardcoded vocabulary can be complete for names mureo does not control — so those three keep the strict rule, and a test pins that they do, including for exactly those names.

The guard that remains, and why it is enough here

The trailing reading still refuses a segment carrying a write verb, because this surface has its own honesty to keep: a plugin mutation misread here hides a real gap inside a batch claiming full coverage. That is a smaller harm than losing a money guardrail, which is why the guarded reading is acceptable here and nowhere else.

The vocabulary is single-sourced from mureo.byod._client_common._MUTATION_PREFIXES — which AGENTS.md calls authoritative — rather than hand-maintained a second time. The first attempt's list was missing patch, publish, attach, detach, cancel and duplicate; that vocabulary already knew all six.

Also

The module docstring claimed two consumers of this vocabulary. There are four: derive_semantics (#517) and learning_reset were never listed. Corrected.

Tests

• test_batch_revertible_unit.py — the KNOWN DEFECT test flips exactly as its docstring predicted, and the batch now reports FULL coverage.
• test_rollback.py — "native names are unchanged" splits into three, the last parametrized over all 13 real mutations plus the 8 adversarial names the review found, so a vocabulary gap fails here rather than in production.
• test_strategy_gate_pattern_fallback.py — new cases pinning that the denial gate does not take the looser rule, for verb-last native reads and for the adversarial plugin names alike.

Verification

• Full suite: 8719 passed, no regressions beyond the 12 that fail on any machine with provider plugins installed and no live credentials.
• ruff, black, mypy clean.