docs(ats): freeze read-only managed tool host v1

[AetherAI3]

Purpose

Freeze the cross-repository E1 contract before Cloud or Agent runtime code lands. The first qualified capability is one foreground, owner-bound, read-only ats_workspace_status call returned to the same managed-agent DM.

Ownership

• Cloud: identity, run/model/UVT admission, host leases, tool offering, durable call/result custody and DM delivery
• Agent: enrolled foreground host, local lifecycle, strict validation, bounded invocation, replay cache and teardown
• ATSv2: authenticated runtime truth now; all future activation, evidence, risk, grants, plans, approvals, adapters, ledger, reconciliation and kill-switch authority
• Agent Browser: observation custody only; browser observation is deferred until an owner-bound session contract exists

Contracted surfaces

• RFC 8785 canonical encoding and domain-separated digests
• Ed25519 Cloud lease/device proof bootstrap and enrolled-device possession
• authenticated ATS observer-channel receipt without a cyclic capability/receipt digest
• closed, self-discriminating RuntimeCapability, ToolRegistryManifest, HostSessionLease, ToolInvocation, ToolCancellation and ToolResult schemas
• explicit frame/depth/string/array/TTL/nonce/signature/call bounds
• complete replay principal, atomic first-terminal-result semantics and byte-identical result redelivery
• exact closed ats_workspace_status output with no paths, source, page/provider payloads, credentials or execution authority
• per-tool dependency fencing so diagnostic status survives writer/runtime/browser degradation
• exact schema-digest and dynamic argument/result second-pass validation rules

Explicit exclusions

No order review, approval, submit, cancel, reconcile, broker credential, account enumeration, strategy activation, executable market evidence, live capital, background host or browser action is introduced.

Dependency and CI repair

This branch includes the exact green head of #158. Its original CI failure was the repository's expired checked-in public model catalogue, not this contract. #158 refreshed the authoritative projection, regenerated derived documentation, repaired time-sensitive fixtures without weakening the freshness gate, and passed exact-head CI and CodeQL. Once #158 lands on main, this PR's effective diff reduces to the E1 contract.

Landing order

1. Review/freeze this contract and golden-vector requirements.
2. Land the closed JSON Schemas, cross-language canonicalization, signatures and golden fixtures.
3. Cloud implements disabled host lease/tool-offer/dedupe/result custody.
4. ATSv2 exposes authenticated bounded read-only status.
5. Agent implements the outbound foreground host and workspace-status tool.
6. Run the exact-commit cross-repository canary.

Paper integration remains blocked until E1 and E2 data/activation work are green. Agent must never become a second broker, risk engine, order ledger or kill switch.