toolplane: say what a create would make, so a person can approve it

[traviswu-bigstack]

What

describe_instance_profile — an unlisted, read-class control tool that reports the flavour, image, network and project a create_instance would use, so the SaaS can name them in the sentence a person approves.

Adds tunnelproto.InstanceProfile as the shared wire shape, and Tool.Unlisted / Entry.Unlisted so the SaaS can tell a deliberate absence from its own tool list from a stale copy.

Why

Validating the write path end to end on the 1cc lab R630 created a VM, watched it reach ACTIVE, and recorded what its approver had read:

flavour, image, network and project are the cluster's own settings, not chosen by the assistant.

Every word true, and a category rather than a machine. The values live in a file on this node; the SaaS composing the prompt had no way to learn them. There is no undo at the operate level, so the person clicking approve is the last check, and they were being shown the least useful true sentence available.

Reviewer notes

It reports values, not a sentence. The wording a customer reads is product copy that should improve without an agent release on every cluster; the values are facts only this node holds. Each side renders the half it is authoritative for.

Unlisted, and why it is published rather than inferred. The model already cannot choose a flavour or an image — that is the profile's entire purpose — so a tool reporting them would widen what the model sees without widening what it can do. It is not a security boundary: the executor serves the name to whoever holds the tunnel, and the level and impact checks are what decide whether a call runs. Without the flag the SaaS's catalogue comparison would need an exception typed out over there, which is the hand-kept copy toolcatalog exists to abolish.

Configured is false for a half-configured profile, not only an absent one. A profile missing any of the three refuses every create, so reporting it as configured would put values in front of a person for a call that cannot run.

callControl answers this before it looks for a probe runner. The guard it bypasses was written for this case — its comment anticipated "a future control tool that is not scratch-class" — and an agent built without a probe plane still has to be able to say what a create would make. TestDescribeWorksWithoutAProbeRunner pins it.

Break and restore, each watched to fail and then restored:

break	failed
flavour no longer crosses the wire	TestDescribeReportsTheProfileACreateWouldUse
catalogue stops publishing Unlisted	TestEveryAllowlistEntryIsPublished, naming the tool

Full suite GO_TEST_RC=0, zero --- FAIL: lines. go vet clean; gofmt clean except cmd/agent/main_test.go, which is unclean on develop already and untouched here.

Docs

bigstack-handbook#638 — A person approves what they can see, in read-only-plane-end-to-end.md beside the other slices.