✨ feat: WP-06 工具域——注册表、四维裁决、审批与 RunBudget

- 迁移 10：tool（注册表：风险级/审批声明/输入 Schema）、tool_call（六态含 pending_approval、幂等唯一约束）、run.max_tool_calls（RunBudget 硬上限）
- 内置工具三件：get-current-time/calculate（AST 白名单四则，只读循律）、record-note（真实副作用：写入记忆候选，必须请命）
- 四维裁决（能力/数据/后果/情境→autonomy_level）：read_only 循律直接执行；side_effect/high_impact 进入 pending_approval 请命；禁用工具 forbidden
- 审批流（朱批）：approve → 执行并落审计；deny → 拒绝且不可逆（重复审批 409）；副作用工具产物走既有记忆审核通道
- 工具入参按不可信模型输出处理：JSON Schema 子集校验（required/type/未知字段拒绝）；RunBudget 超限 422 不静默放行
- 幂等：同 (run, tool, Idempotency-Key) 重放返回 200 原调用
- 测试 67 项全绿（+7）：循律即执行、请命→朱批→真实候选产物、拒绝不可逆与不执行、Schema 三类拒绝、未注册 404、幂等重放、预算硬上限

backend/alembic/versions/b3a26cb61923_工具注册表_调用与_runbudget.py

@@ -0,0 +1,67 @@
+"""工具注册表、调用与 RunBudget
+
+Revision ID: b3a26cb61923
+Revises: a994e5b4337b
+Create Date: 2026-09-11 11:19:50.562943
+
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = 'b3a26cb61923'
+down_revision: str | Sequence[str] | None = 'a994e5b4337b'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('tool',
+    sa.Column('name', sa.String(), nullable=False),
+    sa.Column('description', sa.String(), nullable=False),
+    sa.Column('input_schema', postgresql.JSONB(astext_type=sa.Text()), nullable=False),
+    sa.Column('risk_level', sa.String(), nullable=False),
+    sa.Column('requires_approval', sa.Boolean(), nullable=False),
+    sa.Column('enabled', sa.Boolean(), nullable=False),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.CheckConstraint("risk_level IN ('read_only', 'side_effect', 'high_impact')", name=op.f('ck_tool_risk_level_values')),
+    sa.PrimaryKeyConstraint('name', name=op.f('pk_tool'))
+    )
+    op.create_table('tool_call',
+    sa.Column('id', sa.String(), nullable=False),
+    sa.Column('run_id', sa.String(), nullable=False),
+    sa.Column('tool_name', sa.String(), nullable=False),
+    sa.Column('input', postgresql.JSONB(astext_type=sa.Text()), nullable=False),
+    sa.Column('output', postgresql.JSONB(astext_type=sa.Text()), nullable=True),
+    sa.Column('status', sa.String(), nullable=False),
+    sa.Column('error', sa.String(), nullable=True),
+    sa.Column('idempotency_key', sa.String(), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('completed_at', sa.DateTime(timezone=True), nullable=True),
+    sa.CheckConstraint("status IN ('pending_approval', 'approved', 'denied', 'executing', 'succeeded', 'failed')", name=op.f('ck_tool_call_status_values')),
+    sa.ForeignKeyConstraint(['run_id'], ['run.id'], name=op.f('fk_tool_call_run'), ondelete='cascade'),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_tool_call'))
+    )
+    op.create_index(op.f('ix_tool_call_run_id'), 'tool_call', ['run_id'], unique=False)
+    op.create_index('uq_tool_call_idempotency', 'tool_call', ['run_id', 'tool_name', 'idempotency_key'], unique=True)
+    op.create_foreign_key(op.f('fk_memory_memory_version'), 'memory', 'memory_version', ['current_version_id'], ['id'], ondelete='set null', use_alter=True)
+    op.add_column('run', sa.Column('max_tool_calls', sa.Integer(), nullable=False))
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('run', 'max_tool_calls')
+    op.drop_constraint(op.f('fk_memory_memory_version'), 'memory', type_='foreignkey')
+    op.drop_index('uq_tool_call_idempotency', table_name='tool_call')
+    op.drop_index(op.f('ix_tool_call_run_id'), table_name='tool_call')
+    op.drop_table('tool_call')
+    op.drop_table('tool')
+    # ### end Alembic commands ###