🤖 Claude Code agent instructions

This task is a plan, not an implementation. Branch feature/agent-tools-islandora-workbench (draft PR #123) holds only docs/dev/agent-tools-plan.md. It is stacked on feature/qrate-cli (ASNT-118), which must merge first.

The goal: a plugin declares approved, structured tools that an agent can call, and the Islandora Workbench plugin is built in the same branch as the first real consumer, so every API decision is exercised by preflight and ingest rather than by a synthetic example.

Scope

1. Tool declarations in the plugin descriptor: stable name, description, input and output schema, availability.
2. Permission categories: read-only, local mutation, external side effect.
3. Registration and bounded invocation in crates/plugin-host (time, memory and output limits, like agent_program.rs).
4. A CLI route so every agent reaches the tools the same way: qrate agent tools to list and qrate agent tool-call to run, forwarded through app_control like the other agent commands. The Pi extension then registers them from that listing instead of a hard-coded set.
5. The Islandora Workbench plugin: validate configuration and the selected rows, produce a Workbench plan and a preflight/dry-run report, and expose direct ingest only behind a visible human confirmation.

Rules

• Three repos move together. Anything a plugin can see changes types/qrate.lua in qrate-plugin-template first, then plugins/islandora/types/qrate.lua, then the READMEs, and cargo test -p plugin-host -- --ignored is the only check. Bump API_VERSION (currently 2) only for a breaking change; an optional tools field in the descriptor is not one.
• Host grows capabilities, not arrangements. Add a Lua primitive; do not reshape the Rust host around Workbench.
• No external write without a human. An agent may plan and explain an ingest. It may not start one. The confirmation is qrate UI, not a tool parameter the agent can set.
• AGENTS.md, docs/cli/commands.md and skills/ change with any new qrate agent command.
• The server at isle.dvnl.work answers anonymous JSON:API, not Workbench routes; check what a preflight can verify without credentials before designing it.

Non-goals

A generic tool catalogue with no real plugin behind it. Arbitrary agent execution of plugin code. Silent or agent-initiated ingest.

Definition of done

• An enabled plugin exposes only its declared, approved tools.
• Tool calls validate their input and return structured results or errors.