security: server tool baseline is not durable; replaced inventory or empty review re-triggers auto-baseline of unreviewed tools #1567

Problem

Whether a server "has a baseline" is inferred only from the presence of an approved/changed tool record (serverHasBaseline, internal/runtime/tool_quarantine.go:468-478; isBaselinePass := enforceNewTools && !serverQuarantined && !serverHasBaseline). The fact that a baseline decision was made is not stored durably, so it can be lost:

• Manual-trust server first serves approved tool A; the inventory is later replaced wholesale by new tool B. The removal pass deletes A's record, the next discovery sees only pending records, treats it as first baseline again and promotes B unreviewed. An authoritative empty refresh followed by a new inventory has the same effect.
• Review-bound approval of an empty inventory leaves no evidence of the decision; after unquarantine, a later inventory is auto-approved as the first baseline.

Suggested direction

Persist a per-server baseline marker (separate bucket) when a baseline is established by trusted discovery or by an explicit review commit (including the empty-snapshot case), consulted by serverHasBaseline and cleared only on server removal. Tests: baseline A -> replace with destructive B -> repeated discovery + restart must keep B pending; empty review then later tools stay pending.

Where Sol found it

ux02-r5-chunk1.txt #2, ux02-r6-A.txt #1.

Related: #1566

Found by OpenCode Sol 6.1 cross-model review of the (now split) oversized PRs #1553 (UX-01) and #1555 (UX-02); verified still present on origin/main (704795c) by reading the cited sites. Pre-existing, deliberately out of scope of the minimal core PRs. Review transcripts: docs/qa/0.70.0-ux-2026-10-10/remediation/reviews/.