ecosystem-worker/ecosystem-researcher fail the workflow contract's tools-allowlist checks #394

Follow-up from PR #391 review (Stage 1 client-layer evidence on mac-coordinator-64gb-20260925).

Two pre-existing local.agent-ecosystem agents installed at user scope (~/.claude/agents/,
not tracked in this repository, predating PR #391) fail the tools-allowlist rules that
examples/claude-native/workflows/test-envelope.mjs enforces for this repository's own
project agents:

• ecosystem-worker.md has isolation: worktree and no tools: line at all, so it fails
  the "declares a tools allowlist" check. Per Claude Code's documented subagent behavior, an
  agent with no tools: line inherits every tool, including Serena's symbol-edit tools
  (replace_symbol_body, insert_after_symbol, insert_before_symbol, rename_symbol).
  docs/decisions/2026-09-26-stack-agents-role-dispatch.md removed exactly that grant from
  isolated-builder, because Serena stays bound to the session project inside subagents, not
  to the subagent's own worktree — so a worktree-isolated worker with these tools can edit
  the parent checkout, not just its own worktree.
• ecosystem-researcher.md grants Bash, WebFetch, WebSearch and the wildcard
  mcp__openaiDeveloperDocs__*. The wildcard form fails the same test's "grants MCP tools by
  full name, never a bare server prefix" rule, and the researcher role's grant documented at
  docs/decisions/2026-09-26-stack-agents-role-dispatch.md excludes WebFetch.

Both agents run under this profile's bypassPermissions default (~/.claude/settings.json),
so neither prompts before using these tools.

Ask: either remove/quarantine the two agents, or give each an explicit allowlist that
follows the role table in
examples/claude-native/workflows/README.md#dispatch-by-role-2026-09-26, with no Serena
symbol-edit tools for the worktree-isolated worker role.

Neither agent file is in this repository's diff; this is host-state cleanup, not something
PR #391 itself changes.