Summary

• Emit canonical control-plane runtime metadata for every parent runner-workspace tool.
• Derive runtime metadata from execution location and reject contradictory policy metadata before recipe execution.
• Lock the 14-tool Docs Agent payload from run 29298164272 in regression coverage.

Fixes #1765

Testing

1. Run npm run build.
2. Run npm run test:runtime-tool-policy.
3. Run npm run test:agent-task-contracts.
4. Run npm run test:agent-task-runtime-package-staging.
5. Run npm run test:agent-no-data-machine-loop.
6. Run npm run test:php-tool-policy-normalization && npm run test:php-runner-workspace-tools && npm run test:php-runtime-task-runner && npm run test:php-agents-api-adapter-contract.
7. Run actionlint .github/workflows/run-agent-task.yml.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: Implemented the policy validation and regression coverage with Chris Huber.