Restrict model-facing patch-loop admission to validated findings

[justsml]

Summary

• restrict the model-facing patch-loop tool to persisted, server-resolved validated Findings
• prevent replayed model-authored explicitRequest and requestedBy fields from acting as user authority
• keep internal explicit-request support reserved for a future app-owned deliberate action
• keep ACP execution explicitly unavailable and preserve the structured unavailable result

Why

The existing service foundation intentionally supports explicit user requests, but the model-facing tool exposed free-form request identity as an admission gate. That allowed the model to manufacture authority. This PR closes that containment gap without activating the incomplete ACP runtime.

Verification

• 20 focused integration tests passed across patch-loop tool/core and ACP safety seams
• formatter/static checks passed for changed files
• git diff --check passed
• five council review loops completed; final two independent reviewers reported no blockers

Full repository type-checking is currently blocked by an unrelated existing error in tests/integration/agent-controller-session-release.test.ts:52 (deleteSession is absent on AgentController).

Scope

This is a containment repair only. It does not add the explicit-request UI/server action, enable an ACP process, or claim completion of streaming, evidence collection, deterministic verification, resume, or teardown.

Refs #70

[justsml]

Council review summary: five loops completed. The first three established that the complete ACP tracer is too large and unsafe to expose as one quick repair; loops four and five reviewed this containment diff. Final independent reviewers reported no blockers.

This PR is intentionally limited to server-resolved validated-Finding admission at the model-facing boundary. #70 remains open for the app-owned explicit-request action, confined runner, evidence verification, resume, streaming, and teardown.