test(harness): drift gates for tool/hook/model contracts + honest #3/#4 scoping

[pirumu]

Harden the harness: convert prose contracts to drift gates (weakness #2), with honest scoping of #3/#4

Follow-up to the "no orphan tools" guard. This turns three more prose-level "MUST stay consistent" contracts into machine checks that cargo test already runs — so they can't silently rot.

Drift gates added (all std-only, read-source tests, mutation-verified)

1. catalog ↔ dispatch parity (mcp): every tool advertised in tools_catalog has a dispatch_tool arm and vice versa (27↔27). Catches "advertised a tool but forgot to route it" (errors when the agent calls it) and renamed/orphaned dispatch arms.
2. hook registration ⊆ dispatch (cli): every hook install/hooks.rs registers into settings.json has a ("hook", …) arm in main.rs (10 registered ⊆ 14 dispatched). Catches "registered a hook the CLI can't handle" = a broken install where the hook fires and errors.
3. envelope stamps MODEL first (cli): the worker prompt's first line is MODEL: {model}. Machine-enforces the model-routing contract whose absence once made workers silently inherit the wrong (expensive) model.

Each gate was mutation-checked: renaming one dispatch arm / hook arm / the MODEL prefix makes the corresponding gate fail and name the drift; all pass again after revert. Not fake tests.

Honest scope — what this does and doesn't fix

This was raised as "fix all the weaknesses." Being straight about each:

• [Error] Keep token used to old session by statusline #2 (prose contracts unenforced) — fixed here + in the orphan-tools guard. The tool/hook/model lifecycle is now machine-checked end to end: defined → routed → surfaced → model-stamped.
• feat(addon): add addon management — CLI + slash command + init integration #3 (compiles-green ≠ actually-works) — partially. The drift gates catch the "compiles but isn't wired/routed" slice. The rest — tests must exercise the real code path, not a seeded key (the taint-bug class) — is a testing-discipline problem with no clean one-shot machine gate; it stays mitigated by the anti-fake-test worker rules + required e2e smoke, not by a fabricated fuzzy detector.
• Chore/rename thoth to hoangsa memory #4 (dead code / wide surface) — measured, already clean: clippy reports no dead code in any lib; the only 3 #[allow(dead_code)] are justified (a pub API wrapper, a documentation const, a lib re-export), each with a reason comment. Earlier audit rounds already cut the real dead code. The remaining breadth is architectural (many crates/features) — a design choice, not a defect. No fabricated cuts.

Lint & fmt

• clippy: 0 new warnings from the added files.
• rustfmt (edition 2024): the three new test files formatted and --check-clean. Deliberately scoped to the touched files only — this repo is not uniformly rustfmt'd and a blanket format would churn 100+ unrelated files.