feat: ADR 0032 M3 Slice B — enforce plan gate via interceptor, remove inline gate

Second of the two §13.3 landings. Flips the plan-gate interceptor to enforce
mode (raise_on_deny=True) and removes the now-redundant inline
evaluate_write_gate call from AgentRunner. The plan gate is now solely the
EventSpine interceptor on TOOL_CALL_REQUESTED.

Safe because Slice A (26446d5) proved, with the inline gate still authoritative,
that the interceptor's decision is identical per reason code (parity test green
on a full acceptance run). Denials, reason codes, and pending/failure status
are unchanged.

Constraint: behavior-preserving; same denials and reason codes as the inline gate Slice A proved equivalent; no test assertion changed
Tested: lifecycle, adversarial + first-hour + from-plan 36, smoke 200, acceptance 646/646, full mypy clean 1009 files, ruff check+format clean
Confidence: high
Roadmap-Status: unchanged

Author: johnteee

teaagent/runner/_core.py

@@ -172,19 +172,18 @@ def __init__(
             skip_plan_check=skip_plan_check,
         )
 
-        # M3-T002 Slice A: register the plan gate interceptor in SHADOW mode.
-        # It computes its decision on TOOL_CALL_REQUESTED but does NOT veto;
-        # the inline evaluate_write_gate below stays authoritative. The parity
-        # test asserts interceptor decision == inline decision per reason code.
-        # Slice B (separate commit) flips this to enforce and removes the inline
-        # gate.
+        # M3-T002 Slice B: the plan gate is now the authoritative EventSpine
+        # interceptor (enforce mode). It vetoes TOOL_CALL_REQUESTED by raising
+        # ToolPermissionError when the write is blocked by plan policy or
+        # read-only lint. Slice A proved its decision equals the (now removed)
+        # inline gate per reason code.
         self._plan_gate_interceptor = PlanGateInterceptor(
             self.plan_validator,
-            raise_on_deny=False,
+            raise_on_deny=True,
         )
         self.event_spine.register_interceptor(
             self._plan_gate_interceptor,
-            name='plan_gate_shadow',
+            name='plan_gate',
         )
 
         self.auto_mode_manager = AutoModeManager(
@@ -641,9 +640,10 @@ def _execute_tool_decision(  # noqa: C901
                 arguments=decision.arguments,
             )
 
-        # M3-T002 Slice A: emit TOOL_CALL_REQUESTED so the SHADOW plan-gate
-        # interceptor records its decision (it does not veto). The inline gate
-        # below remains authoritative until Slice B.
+        # M3-T002 Slice B: the plan gate is the EventSpine interceptor. Emitting
+        # TOOL_CALL_REQUESTED runs it; it raises ToolPermissionError if the
+        # write is blocked. The inline evaluate_write_gate was removed here —
+        # Slice A proved the interceptor's decision is identical.
         tcr_payload: dict[str, Any] = {
             'tool_name': decision.tool_name,
         }
@@ -658,15 +658,6 @@ def _execute_tool_decision(  # noqa: C901
             tcr_payload,
         )
 
-        # M3-T002 Slice A: inline plan gate stays authoritative (removed in B).
-        gate_error = self.plan_validator.evaluate_write_gate(
-            tool_name=decision.tool_name,
-            context=cast(dict[str, Any], context),
-            tool_arguments=decision.arguments,
-        )
-        if gate_error:
-            raise ToolPermissionError(gate_error)
-
         # Auto mode: block disallowed tools, auto-approve allowed ones
         self.auto_mode_manager.validate_tool_allowed(decision.tool_name)
         auto_approve_policy = self.auto_mode_manager.get_auto_approve_policy()