Give the coder read, write, edit and bash as first-class tools #127

The coder's only way to touch a file is shell. Every read is cat, every
write is a heredoc, every edit is sed or a rewrite — so the model spends
tokens on shell quoting, and the transcript records a shell invocation where it
should record an intent.

Pi solved this in one commit at the very start of its coding agent
(earendil-works/pi, ffc9be886, "Agent package + coding agent WIP"), with
four files totalling 158 lines: read.ts 29, write.ts 31, edit.ts 61,
bash.ts 37. That is the whole of it, and it is worth copying because of how
little it is.

What the four originals do

• read — one parameter, path. Resolve, check it exists, return the whole
  file as text. Errors come back as a string the model can read, not an
  exception.
• write — path and content. mkdir -p the parent, write, report
  Successfully wrote N bytes. Creates or overwrites.
• edit — path, oldText, newText. Exact-match replacement, and the
  two refusals are the design: it refuses when oldText is not found, and
  it refuses when it is found more than once, telling the model to add
  context until the match is unique. That single rule is what makes a
  surgical edit safe without a diff format.
• bash — command, 30s timeout, 10 MB buffer, stdout with stderr appended
  under a STDERR: marker.

Pi's default active set is exactly read, bash, edit, write, with
grep, find and ls available read-only.
(docs/teardowns/2026-07-21-pi-agent-teardown.md §3.4.)

What to build

Rust equivalents in crates/openagents-cli/src/tools.rs, declared beside
shell, skill, openagents, capability, delegate and acp. Keep them
this small. The point of the reference is its size.

What ours must do that the originals did not

These are not embellishments — each one is a defect this repository has already
shipped and fixed once:

• A bounded cut steps back to a character boundary. A byte index into a
  String has panicked here ten times, including on the path whose job is
  reporting a refusal. tracker::floor_char_boundary exists; use it.
• A failed tool reports is_error: true. shell reported every failure as
  a success until recently, so a failing build read like a passing one.
• A refusal names what went wrong and returns it as output, exactly as pi
  does — the model reads the refusal and retries. It must never be a silent
  empty result.
• write and edit stage and rename rather than writing in place. A
  reader in the truncate window otherwise sees a half-written file; see #114.
• No path escapes the session's working directory without saying so.

Tests

Assert the behaviour that makes edit safe: a oldText appearing twice is
refused and the file is unchanged. Assert read on a missing file returns a
refusal rather than raising. Assert a non-zero bash exit is reported as an
error. Verify adversarially — revert each guard and watch the test fail.