What Problem This Solves

Lean local-model mode defaults structured Tool Search on, which catalogs every non-control tool. That also hid exec, so coding-tuned local models could see only the Tool Search controls even when policy allowed shell access. This replays the useful part of #87587 against current main; the contributor branch is stale and does not allow maintainer edits.

This addresses only the direct-shell-visibility slice of #86632. It does not claim that every local model will choose correct commands or successfully retrieve live data.

Why This Change Was Made

The existing catalog-compaction owner already accepts a per-tool predicate. This change adds one lean-model predicate and passes it through both runtime owners: the embedded attempt path and the shared harness bridge.

The exception is intentionally narrow:

• only policy-filtered exec stays directly visible;
• only resolved structured Tool Search tools mode gets the exception;
• explicit code and directory modes retain normal compaction;
• no alias, routing heuristic, fallback stack, or permission bypass is added.

User Impact

Lean local models can directly select exec while the rest of the normal tool catalog remains compact. Existing tool allowlists, denylists, sandboxing, approvals, and hooks still decide whether and how exec can run.

The local-model docs now state that boundary. The changelog credits @vincentkoc for the original diagnosis and implementation direction.

Evidence

• Blacksmith Testbox, exact merged head: corepack pnpm test src/agents/local-model-lean.test.ts src/agents/harness/tool-surface-bridge.test.ts src/agents/tool-search.test.ts — 66 tests passed.
• Regression coverage proves the embedded/harness tools surfaces keep controls plus exec, catalog read, and leave explicit code mode unchanged.
• Repository formatter check passed for all nine changed files; git diff --check passed.
• Fresh autoreview: clean, no accepted/actionable findings, correctness confidence 0.93.
• Isolated live A/B with Ollama qwen3.5:9b: the lean default exposed only Tool Search controls and the model fabricated a weather answer after an empty search; direct exec visibility caused the model to select shell commands instead. The attempted commands were invalid, so this is visibility proof, not end-to-end weather-success proof.
• Upstream contract checked: Ollama tool calling and the qwen3.5:9b model card.

Replaces #87587 while preserving contributor credit in the commit.