feat: seven file tools behind the policy and an approval

The file tools are absent from the list unless file access is on, which is the
difference between a model that cannot call them and one that is told not to. Each
handler is thin: argument checks here, and the operation itself in files.ts.

move_path reads `from`, not the shared path helper, which is the bug the tests
caught: an empty source path would have been refused by the policy on every move.

src/lib/agent.ts

@@ -249,6 +249,10 @@ export async function runAgent(options: AgentOptions): Promise<AgentResult> {
         now: options.toolContext.now,
         signal: options.signal,
         sources,
+        // The policy and the ledger travel with the turn, so a second write to a path
+        // the user already approved does not ask again, and a new question starts
+        // asking from the beginning.
+        files: options.toolContext.files,
       });
 
       const record: ToolCallRecord = {