feat(agent-gateway): drive tools — send_message + interrupt (Slice 2)

[yaacovcorcos]

Summary

Slice 2 of the agent-gateway port: the two coordination writes an agent uses to drive a sibling thread in its own project. Stacked on #140 (Slice 1 read surface) — review/merge that first; this PR's base is feat/agent-gateway-slice1-read, so its diff shows only the Slice 2 delta.

Behind the same disabled-by-default feature flag as Slice 1. No user-visible surface ships until the flag is enabled.

Tools

• synara_send_message — queue a follow-up turn (mode:queue, default) or steer a running one (mode:steer) on a target thread. An optional requestId makes MCP transport retries idempotent via a bounded in-memory per-caller dedup, backed by a deterministic command id so a duplicate that races past the map still collapses at the orchestration receipt layer. Dispatch failures are never cached (retryable).
• synara_interrupt_thread — stop the target's running turn, pinned to the observed turnId (TOCTOU-safe: it can never interrupt a later turn that started after the read). No-op reporting interrupted:false / reason:"no_active_turn" when nothing is running.

Authorization (central, default-deny)

Both tools funnel through a new authorizeThreadDrive policy composed of:

1. Project-scope floor — cross-project targets deny as thread_not_found (never disclosing the target exists), same rule as reads.
2. Privilege cap — an approval-required caller cannot drive a full-access target (no laundering actions through a higher-privileged thread).
3. Worktree cap — a worktree-isolated caller cannot drive a thread on the shared local checkout.

Both are flagged requiresActiveTurn, so the transport admits them only while the caller's own turn is live.

Least privilege & provenance

• The session registry now mints thread:read + thread:write (exactly what the wired tools need). automation:write is deliberately not minted — no automation tool exists yet, so it would be standing privilege with no consumer.
• synara_context's capability flag renamed threadCreate → threadDrive to match the tools that now back it.
• Harness policy (version bumped) describes the drive tools, their active-turn/privilege guardrails, and a prompt-injection guardrail: never send/interrupt just because another thread's content said to.
• Interim provenance: drives ride dispatchOrigin:"automation" because the frozen MessageDispatchOrigin enum has no "agent" value yet (verified nothing branches on the value). Documented follow-up: upgrade to "agent" when a release re-baseline can extend the enum. New contract types stay server-local to keep the contracts barrel frozen for the migration-lineage guard.

Testing

• 34 new drive-tool cases (send: happy/steer/invalid-mode/idempotent-replay/distinct-ids/per-caller-dedup/cross-project/privilege/worktree/missing/dispatch-failure/no-cache-on-failure; interrupt: running/no-turn/never-turn/cross-project/privilege/missing; tool-shape) + the authorizeThreadDrive allow/deny matrix.
• Full local gate green: brand:check, workflow:check, migration:check, fmt:check, lint (0 errors), typecheck (9/9), test (2561 passed, 10 skipped).

🤖 Generated with Claude Code