feat(control): add Root Agent Code Management command with confirmation gate #906

Motivation

Agent Management MCP is deliberately scoped to the caller's own project tab, and the external operator control server is deliberately never installed into agents running inside Agent Code. That is the right default. It leaves one rare, supervised situation with no supported path: after an agent has audited the whole fleet, the user wants that same agent to reorganize the workspace (every project tab, layout, placement, focus) so only the work that needs attention is open.

Today the only ways to get there are to drive the UI by hand or to enable the external operator server and connect a separate client. Neither lets the agent that already holds the audit context do the reorganization.

Intended behavior

• A new session command, Root Agent Code Management, in the command picker (advanced tier). It is a per-agent toggle, off by default, and never a Settings default for new agents.
• Turning it on opens a confirmation dialog first. The dialog explains, in plain language, what the switch grants (application-wide control over every window, project, agent, terminal and layout through the same tools an external operator uses) and why it is usually the wrong switch (blast radius beyond the agent's own project, model-driven changes to unrelated work, intended only for rare supervised moments). Confirming reloads the agent with the capability; cancelling changes nothing.
• Turning it off reloads the agent without the capability and needs no confirmation.
• While on, the agent's built-in MCP exposes the operator control catalog (ac_* tools) with instructions that state the switch was a deliberate user action, name the agent's own session so it never targets itself, and keep destructive steps behind the user's explicit current request and the app's own confirmation dialogs.
• Persisted with the session's other built-in MCP domains, so a reload keeps it until the user turns it off.

Acceptance criteria

• The domain cannot become a new-agent default: the configurable-defaults normalizer drops it and no Settings row offers it.
• Enabling from the command opens the confirmation and does not reload; confirming reloads with the domain added to the session's existing domains; declining leaves the session untouched.
• Disabling reloads without a confirmation.
• With the domain on, the built-in MCP server publishes the operator tools with the same names, input properties and descriptions as the external operator server, and calls reach the control executor with the agent as caller; application-only capabilities stay hidden and uncallable.
• Without the domain, no ac_* tool is registered.
• Deterministic tests cover each of the points above; tsc passes on both projects.