[vanedaltro]

Add the capability-owned binary tool so model calls can inspect/read/search exact source bytes and apply reviewed expected-digest patches without accessing manual editor drafts.

• Bound reads to 4 KiB, hash editable-sized live sources in chunks, and preserve exact decimal offsets and literal-search limits. Plan reads remain available; fully denied reads hide the tool.
• Bind each patch namespace to its dispatched Session/call and canonical payload. Require the prepared whole-base digest and exact bytes for every splice, then run ordinary byte-diff permission approval before filesystem mutation ownership.
• Reuse durable native save/receipt/notification handling. Retain an independent binary checkout lease and actual path/lifecycle owners after caller disposal; refresh invocation, ancestor, read/edit, agent and sandbox authority immediately before save intent. Serialize the tool and disable automatic retries.
• Forward the independent lease through the production AppHost and document the current scope in README, roadmap and the approved OpenSpec change.

Validation: 83 binary-core tests passed (one process-death helper ignored in this selector); independent checkout-lease regression; five scripted real-runtime model-tool tests; all 45 general tool tests; six retained server-worker regressions; core/server/tools all-target Clippy; formatting/diff checks; strict OpenSpec validation (114 items). The dedicated AppHost regression and app all-target Clippy passed; cross-platform CI is pending. No external provider was called by these tests.

Remaining under #94: dedicated model receipt recovery, configured retention/checkpoint/rewind adapters, remaining recovery/accessibility UX and named performance/platform acceptance. This PR does not close #94.