[3P] Tier-1: declarative agent schema + open tool catalog + shared runtime

[serge-ivo]

Part of the open-to-third-party program (epic to follow).

Goal: a third party defines an agent as pure declarative config — no platform PR.

• Formalize the declarative agent definition (extend `agents.config`): identity, prompt, guardrails, model, `tools[]`, `surfaces[]`, `runtime`, `settingsSchema`. Versioned.
• Open the capability vocabulary. Today `AgentSurface`/`workflow` in `lib/agent-capabilities.ts` are hardcoded closed unions → any new agent shape needs a monorepo PR. Replace with a platform tool/surface catalog the creator picks from (allowlist), so new agents are data.
• Untrusted agents get only declarative surface types — the existing `CustomSurface` "loads code into the console origin" and must NOT be exposed to third parties (or must be sandboxed) — see the Tier-2 issue.
• Generalize the `AgentDO` chat loop into the shared multi-tenant runtime (~80% there per docs/agent-platform-strategy.md) so any declarative agent runs on it.
• Migrate `repo-chat` (already config/data) onto the formal schema as the first dogfood.

[serge-ivo]

Progress (2026-08-01): the Tier-1 foundation has landed on main:

• ✅ PR feat(agents): declarative tool catalog + per-agent tool allowlist (#51) #59 — data-driven TOOL_CATALOG + per-agent capabilities.tools allowlist
• ✅ PR feat(repo-chat): declare tools as data — first exemplar of the creator way (#51) #61 — repo-chat dogfooded onto it (declares tools as data, migration 0050)
• ✅ PR feat(agents): formal declarative agent-definition schema (#51) #62 — formal AgentDefinition + sanitizeAgentDefinition (emits the agents.config shape)

Remaining: wire POST / + PUT /:id to accept a full definition (validate → persist config → init DO from identity/guardrails), then converge onto the shared multi-tenant runtime. Docs synced (strategy doc, third-party plan, README, CLAUDE.md).

[serge-ivo]

Correction: the AgentDefinition schema from PR #62 was removed (commit f471ee1) as unwired dead code — it had no consumer (create/update was never wired to it). The tool catalog + capabilities.tools (PR #59) stays live (repo-chat uses it). Rebuild the definition schema together with the create/update route when that slice is actually done.