Require technical bootstrap workspace writes

[chubes4]

Closes #177

Source Relationship

• Source evidence: hosted technical-bootstrap failures 29752036605 and 29752395466. Both had the bootstrap package and write tools but completed without writes; the host correctly rejected missing docs/README.md with BOOTSTRAP_REQUIRED_PATH.
• Change kind: Docs Agent native-package behavior and immutable package-pin update, with deterministic native runtime coverage.
• Scope: only technical-docs-bootstrap-agent gains the Agents API require_tool_use gate for workspace write/edit/apply-patch tools. The gate is not applied to technical maintenance or other no-change-capable lanes.
• Why this is not broader: the gate addresses only the observed prose-only completion path on fresh technical bootstrap surfaces. Existing strict completion validation and publication requirements remain unchanged.

Changes

• Require the technical bootstrap package to execute a qualifying workspace write before natural completion.
• Advance generated package provenance to a51e79ac698610177852170332a1135a9c315951 and bootstrap digest to sha256-bytes-v1:124924f004474d5296294a3f2c99285d0848c46ed622926b1b283ed018b2bcf0.
• Exercise the real Agents API gate against a fresh surface: prose-only completion is blocked, while a workspace_write to docs/README.md permits completion.
• Preserve maintenance evidence-backed no-change behavior.

Verification Capability

Deterministic coverage proves the native package is imported with the actual runtime gate, blocks completion without a workspace write on a fresh docs/README.md-absent surface, and releases after the write call. It does not parse final prose.

Stranger-Runnable Tests

1. php tests/validate-docs-agent-packages.php
2. php tests/validate-docs-agent-completion-contract.php
3. php tests/validate-external-native-package-sources.php
4. php tests/repair-docs-links-smoke.php
5. AGENTS_API_DIR=/path/to/agents-api php tests/native-agent-import.php
6. WP_CODEBOX_DIR=/path/to/wp-codebox php tests/validate-wp-codebox-run-agent-task-contract.php
7. actionlint .github/workflows/*.yml
8. git diff --check

Compatibility

Technical bootstrap now requires at least one real workspace documentation write before completion. This intentionally makes fresh bootstrap runs fail closed rather than prose-complete. Technical maintenance and other no-change-capable lanes remain compatible with clean evidence-backed no-change outcomes.

AI Assistance

Assisted by OpenAI GPT-5.6 Terra via OpenCode/Homeboy.