…tool-arg rejections) (#1470)

* test(skills): block system and external skill mutations

* fix(tools): schema-aware coercion of per-call meta argument names

ChatGPT-trained models (Qwen3.6) name the per-call meta fields the ChatGPT
way — TimeoutSeconds/Rationale/bare Timeout instead of the canonical
_timeout_seconds/_rationale/_background. Since #1398's loud validation, those
near-misses are hard-rejected ("tool was NOT executed"), which pushes the model
off tools and into emitting ChatGPT-style sandbox: download links instead of
calling attach_file (observed in sessions D0AC6CKBK5K_1781746527 and
C0B1GKNLZD3_1782215358).

Resolve a supplied key to a meta field when its normalized form matches a
canonical name AND the tool does not declare a real parameter that binds to it.
This is schema-aware: a third-party MCP server's own 'timeout' parameter is
forwarded untouched, while the model's near-miss is still coerced where no such
parameter exists. The value is consumed, never silently dropped — preserving the
no-silent-fallback invariant #1398 established. Ambiguous double-spellings and
invalid values are still rejected loudly.

- ToolArgumentValidator.ResolveMetaField(tool, key): single schema-aware resolver;
  validator cache switched to instance-keyed (ConditionalWeakTable) so MCP tools
  sharing McpToolAdapter no longer conflate schemas.
- ToolCallMeta.ExtractFrom / ValidateMetaValues / Extract take a resolver delegate
  (default exact, schema-blind) used by persistence; the executor passes the
  schema-aware resolver via IToolExecutor.PrepareToolCall.
- Sub-agent loop now runs ValidateToolCall -> PrepareToolCall -> apply timeout hint,
  the same shared seam as the main pipeline (it previously skipped extraction and
  silently dropped the hint).
- Loud default in the meta switch; dead SuggestFor branch removed; recognition
  loops merged.
- netclaw-operations skill v2.15.0; tool_timeout_arg_recovery eval comment updated.

Full Netclaw.Actors.Tests green (2471); Daemon provider-boundary green (91);
slopwatch clean; headers verified.

* refactor(tools): unify tool-call interpretation seam; close meta-arg review findings

Follow-up to the schema-aware meta-arg change (d43a16f), addressing an xhigh
code review. Three substantive fixes plus cleanups.

Correctness — ambiguity guard now covers MCP. The 'two keys map to one meta
field' guard lived only in ToolArgumentValidator.ValidateArgumentKeys, which the
executor skips for MCP tools; but MCP gets schema-aware near-miss extraction, so a
double-spelled meta key on an MCP call silently last-write-wins. Moved the guard
into ToolCallMetaExtractor.ValidateMetaValues (runs for every tool via
DispatchingToolExecutor.ValidateArguments), checked ahead of value errors so it
keeps priority. Removed the now-redundant guard from ValidateArgumentKeys.

Altitude — one InterpretToolCall seam. Added IToolExecutor.InterpretToolCall
(returns rejection? + meta + cleaned), which resolves the tool and builds the meta
resolver ONCE, then validates and (only on success) extracts via a shared
ValidateCore. The main pipeline and the sub-agent loop both route through it instead
of calling ValidateToolCall then PrepareToolCall as two un-ordered steps (removes the
double registry lookup and the extract-without-validate footgun). Timeout-hint
application centralized in ToolExecutionContext.ApplyMeta (used by the sub-agent's
two sites). Sub-agent's intentional ignore of _background/_rationale is now
commented.

Persistence matches runtime — ChatMessageConverter.FromAiMessage takes an optional
schema-aware interpreter; LlmSessionActor passes the executor's PrepareToolCall at
the tool-call persistence site, so a near-miss meta key is stripped and captured in
MetaJson in recorded history (was persisted raw, schema-blind). Default stays exact
for tests/replay.

Cleanups: PrepareToolCall default delegates to ToolCallMetaExtractor.Extract;
ValidateArgumentKeys computes NormalizeKey once; removed the stale 'exact-match for
MCP' docs and the duplicate XML-doc on ResolveMetaField; added a loud default in the
ExtractFrom meta switch plus a test that every MetaFieldNames entry is bound.

Accepted (documented): undeclared near-miss on additionalProperties:true MCP
schemas (off the declared interface; narrow); ConditionalWeakTable vs
ConcurrentDictionary micro-cost (CWT required for per-instance MCP schemas).

Tests: MCP ambiguity rejection; InterpretToolCall success/rejection; persistence
near-miss round-trip; exact-resolver tests renamed off the misleading 'MCP' name;
meta-field coverage guard. Full Netclaw.Actors.Tests green (2476); Daemon
provider-boundary green (91); slopwatch clean; headers verified.

* fix(sessions): preserve per-call meta hints across tool-batch re-drive

A tool call that needs approval, whose session passivates before approval and
then cold-recovers, is re-driven through ChatMessageConverter.ToAiMessage, which
rebuilt the call from ArgumentsJson only and never re-injected the meta hints that
persistence had stripped into MetaJson. So the re-driven execution extracted no meta
and silently fell back to the default timeout — dropping the agent's _timeout_seconds
(and _background/_rationale). This reproduced the original 'long call killed at the
default timeout' symptom on the post-approval re-drive path.

Pre-existing (it affected canonical _timeout_seconds before the meta-arg work too;
MetaJson was written and round-tripped but only ever read by CompactionPromptBuilder,
never by the re-drive dispatch). Surfaced by the deep persistence review.

ToAiMessage gains a reinjectMeta flag (default false): when set it parses the
persisted MetaJson and re-injects the canonical keys (_rationale/_timeout_seconds/
_background) into the reconstructed arguments, so the re-dispatched call's extraction
reapplies the hint. RedriveToolBatchForApproval opts in; the other four ToAiMessage
callers (outbound provider history, compaction, sub-agent) keep it false — the model
must never receive meta keys. Re-drive reconstructs for execution only (not
re-persisted), so no meta keys leak back into the journal.

Test: ToAiMessage_reinjectMeta_restores_hint_for_redrive_but_not_outbound proves
the strip→reinject→re-extract round-trip restores the 1800s hint on re-drive while
outbound history stays clean. Full Netclaw.Actors.Tests green (2477); slopwatch clean;
headers verified.