Read agent capabilities, scoped permissions and delivery

The tool policy generation this caller may inspect. Each row is one tool with its operations; an operation carries its included and excluded coverage, its scoped permission rules and a permission summary. The status also lists delivery per context (mode and budget band, and whether the context follows the app default) and the capability narrowing per client or profile. Membership, permission and delivery are separate facts: an included tool can be denied, and an excluded tool can carry an Allow. generationId and catalogId are what a preview must name, and canEdit says whether this caller may prepare and apply commands. Requires tools:read.