Operate an authorized Mac host/device control [write]

Calls an exact host/device operation, or download, downloads, download_status, cancel_download on an owned browser mount. Browser download arguments are {ref,file_path,replace_existing?}; ref is the current read_page AX ref of an actual download anchor, never a URL. Status/cancel use {download_id}, list uses {}. Download requires current workspace, site and output-folder authorization. Status completion includes output.file_path, size_bytes and sha256. Human downloads are not agent-owned and cannot be cancelled. Cancel returns saving while an admitted native commit awaits its receipt; read download_status for the final receipt. All POST operations, including downloads and download_status, require a personal write key; the GET tools directory requires read scope. Each operation's host, device administration, destination, path and OS permissions remain enforced. A required_action response identifies a permission that needs setup. Reuse the stable request_id when retrying to avoid duplicate writes. Raw IPC names are refused. A tool-level error remains content/isError rather than a claimed success. The whole relay request envelope is limited to 1 MiB, including JSON and base64 expansion.