test(operations): route the remaining operations tests through the gate

[AlexMost]

Second of four PRs for #112. Migrates the nine remaining files in
test/operations/tools/ to callTool, adds a list_properties suite (the one
operations tool with no test file), and adds the coverage the suite never had:
per-tool coercion, strict unknown-key rejection, and rejection of a vault
argument in single-vault mode.

Operations tool tests: 11 files, 140 tests (was 10 files, ~100).
Full suite 1331 passing; npm test, npm run lint, npm run typecheck all green.

Acceptance

grep -rn '\.handler(' test/operations/tools/ returns only the two edit_note
WRITE_FAILED tests, each commented. Their subject is the CallToolResult
envelope (isError + structuredContent), which callTool unwraps away, so
they stay handler-direct on the registration by design.

Triage — tests the migration changed

Two previously-green tests were passing against behaviour the gate makes
unreachable. Neither was weakened, and .strict() was not relaxed anywhere.

create_note — throws VAULT_NOT_FOUND when vault is provided but unknown.
The fixture used a single-vault registry and passed vault: 'ghost'. In
single-vault mode vaultParamShape omits vault from the schema entirely, so
the gate rejects it as an unrecognized key and the handler never runs —
VAULT_NOT_FOUND is unreachable through that rig. Fixed the fixture: it now
registers two vaults, so the parameter is declared and the error stays covered.
A comment records why. The single-vault rejection is covered separately by the
new rejects a vault argument in single-vault mode test.

set_property — rejects null/undefined value with UNSUPPORTED_VALUE_TYPE.
A false pin. value is
z.union([z.string(), z.number(), z.boolean(), z.array(z.string()), z.array(z.number())]),
so null never survives the gate. What a client actually sees is
INVALID_PARAMS at path value; the test now asserts that, with a comment
naming the branch it used to reach.

Finding — no change made, out of scope here

set_property is the only caller of inferTypeAndValidate
(src/modules/operations/tool-helpers.ts), and all three of its
UNSUPPORTED_VALUE_TYPE throws are unreachable behind that union: null or
undefined, a list element that is neither string nor number, and a non-scalar
value are each rejected by the gate first. UNSUPPORTED_VALUE_TYPE is still
declared in OperationsErrorCode (src/modules/operations/types.ts). This PR
is tests-only by design, so the dead branch is left in place — it deserves its
own change rather than a drive-by deletion here.

Plan deviation

Plan Task 4 Step 2 asserted provider.createNote is called with
objectContaining({ frontmatter: { type: 'idea' } }). The tool never forwards
frontmatter — it serializes it into content. The test asserts the serialized
content instead; the coercion under test (JSON string -> object) is unchanged.

Refs #112

🤖 Generated with Claude Code