refactor(tools): move network tools to tinytools-std behind NetGate (wave 4)

[senamakel]

Summary

Vendor-extraction wave 4: the network tools move to tinytools-std behind a NetGate trait, following the same pattern as the Wave 3 FsGate move.

crates/openhuman-core/src: 603,797 → 600,857 lines (−3,972 moved, +594 host adapter).

Depends on:

• feat(std): network tools behind NetGate, plus image_info and read_workspace_state tinytools#39
• chore: bump tinytools (network tools, image_info, workspace_state) tinyagents#250, which bumps the tinytools gitlink.

The vendor/tinyagents gitlink points at the #250 head. I'll re-pin to the merge commits once they land.

What moved (to tinytools-std)

• network::{http_request, web_fetch, curl, pushover}. These are gated by NetGate, which covers:
  • can_act, is_rate_limited and record_action;
  • network_needs_approval;
  • local_only_block;
  • disclose (egress);
  • prepare_client and timeout_client (proxy, TLS).
• filesystem::workspace_state. It now shares git_operations::config hardening, and its own older duplicate is deleted.
• filesystem::image_info. It validates paths through FsGate.
• agent/triage strip_trailing_commas. It now uses tinytools_agent::repair::json. The host copy mangled non-ASCII text by pushing bytes as chars.

What stays host-side

• impl NetGate for SecurityPolicy (tools/impl/network/gate.rs).
• The x402 402-retry, as an X402PaymentHook behind the web3 feature.
• The HTML→Markdown step, as a tinyjuice HtmlExtractor. tinyjuice depends on tinytools, so it cannot move there.
• summary_focus, injected as a schema property.
• The HttpRequestConfig limits, passed in as HttpLimits.
• Tests that need a real SecurityPolicy.

Tool names, descriptions and schemas are pinned by literal JSON fixtures upstream, with a host fixture for web_fetch including summary_focus.

Behaviour changes (intentional)

• workspace_state follows the stricter upstream git policy.
  • core.worktree is refused.
  • Worktree-scoped config is inspected.
  • Unreadable config fails closed.
  • In a non-git directory the Git Status line now shows the refusal reason instead of git's own error.
• curl keeps its lexical resolve_dest. It was not routed through FsGate, because that would have changed behaviour.

Verification

• Vendor:
  • tinytools-std 483 and tinytools-agent 378 tests pass.
  • fmt and clippy -D warnings are clean.
• OpenHuman compile: every test target builds with product features. The app manifest, the embed and tinyhumans crates, and a build without web3 also compile.
• OpenHuman lib suite: 9673 passed and 2 failed. Both failures are known on base 629f8e1:
  • credential_scrub::browser_confirmation_token_survives_without_exempting_page_credentials;
  • the flaky sync_activity::stale_entries_are_pruned_on_the_next_touch.
• CI scripts:
  • Feature forwarding, the gated-test allowlist (updated) and submodule monotonic pass.
  • rust:layout has only the baseline entries. The tools/ops.rs pin is lowered.
  • The runtime-boundary check reports no new violations.
• Pre-existing on base: check-module-pins fails after fetching tags (tinymemory now describes as v1.18.0-3, among others). This PR moves no module pin.

Summary by CodeRabbit

• Changes
  • HTTP requests and web fetches now use the shared tool provider, retaining their existing limits and policy checks. HTML responses can be converted to Markdown, and eligible payment-required requests can be retried with payment.
  • Network access continues to respect privacy and approval settings, with external transfers disclosed.
  • The curl, Pushover notification, and workspace status tools are no longer available.