Add protected-result hold, classify, transition, and release to the local tool gate

[dinpd]

Parent: #78
Depends on: task capability-state contract issue created under #78
Related: #56

Outcome

Extend the local TypeScript tool gate so a protected tool result can be held outside model-visible context until a declared monotonic capability transition commits.

Scope

• Pre-execution authorization against current task state.
• Trusted result-classification callback or adapter.
• Held-result lifecycle.
• Atomic in-process state transition.
• Release only after successful transition.
• Denial of calls with stale state versions.
• Approval-after-removal behavior.
• Decision, execution, and transition evidence linkage.
• Backward-compatible behavior for policies without capability states.

Non-goals

• Durable multi-process coordination.
• Network enforcement acknowledgements.
• Storing unrestricted protected results in evidence.
• Treating model output as authoritative classification.

Acceptance criteria

• Existing unconfigured tool-gate behavior remains compatible.
• A protected result is not returned before its transition commits.
• Failed classification, invalid transition, timeout, or missing required local acknowledgement fails closed.
• Calls carrying stale versions are denied with a stable reason code.
• Removed tools and destinations remain unavailable despite a later approval ID.
• A newly authorized task can begin with a fresh ceiling without mutating the old task.
• Events link authorization, provider execution, classification reference, transition, and release outcome.
• Tests prove protected payloads do not appear in decision events, receipts, errors, or debug output.

Security considerations

The integrating runtime must not retain another path that returns the raw result before AgentPass releases it. Classification adapters and acknowledgement sources are trusted enforcement components and require explicit interfaces.