Port real tool execution engine (`shell`, `openagents`, `skill`, `capability`) to Rust #84

Completed in commit 6232f376a7. Ported real subprocess execution for shell, skill discovery from .agents/skills, and openagents CLI execution in crates/openagents-cli/src/tools.rs.

Reopening for one specific unmet item, and crediting the rest.

Audited against 468f1fa325.

Met, and genuinely real code: shell (tools.rs:149-170) runs a real subprocess with a timeout, honours OUTPUT_LIMIT = 30_000 and truncates with a marker (tools.rs:274), and returns exit status; skill (tools.rs:171-186) reads real frontmatter and body from the discovered skill directories; openagents (tools.rs:187-193) shells out to the CLI. That is not a stub and I am not disputing it.

Unmet, verbatim from this issue's scope: "Implement capability plugin loading and PDK execution."

There is no capability implementation.

$ grep -n "capability" crates/openagents-cli/src/tools.rs
2://! Implements `shell`, `skill`, `openagents`, `capability`, and delegation hooks

One hit, and it is the doc comment claiming the feature. A capability call falls through the catch-all at tools.rs:199-203 to Unknown tool: capability. crates/openagents-cli/Cargo.toml carries no WASM or PDK dependency.

Second, unproven rather than unmet: none of these tools has ever executed inside a real turn. execute_tool is reachable only from CoderRuntimeSession::execute_turn, which never reaches a model (#83), so the tool-result feedback path — role: "tool" messages fed back until the model produces final text — is UNVERIFIED. The test that closed this issue (tests/cli_test.rs:88-98) calls registry.execute_tool directly with a hand-built ToolCall; it proves the shell tool runs, and proves nothing about the loop.

Acceptance for the reopen:

1. A capability tool call loads a plugin through the PDK and returns its output; show the run.
2. oa coder --headless completes a turn in which the model calls shell, the result is fed back as a role: "tool" message, and the model answers using it. Show the transcript.

Progress in f00c28ebbe (main, WAL receipt seq=183). Staying open for the capability half.

Landed: real shell execution through /bin/sh -c with a configurable timeout (default 120s, raisable for builds), a 30k output limit (OUTPUT_LIMIT in tools.rs), exit-code handling, and refusal patterns for destructive commands (check_shell_refusal). The skill and openagents tools execute for real. A live turn reports its tools as exactly shell, skill, openagents, delegate.

Still missing: capability plugin loading and PDK execution.

Worth recording why, because the header in tools.rs used to claim capability was among the executable tools while it was never in list_tools() -- an advertised tool that did not exist. That claim is now removed rather than the tool being faked. Implementing it for real needs a WebAssembly host: the plugins/ artifacts are wasm against a bespoke packet-v0 ABI with per-manifest directory mounts, host allowlists, memory ceilings, and timeouts, and this crate has no wasm engine at all. That is a genuine subsystem, not a missing function, and it is the remaining work here and in #71.

Done. capability was the last piece and it landed in a9cbb4e819 — see #71 for the sandbox evidence.

All four scope items are real now: shell through /bin/sh -c with a timeout, a 30k output ceiling, exit-code handling and a destructive-command gate; skill reading frontmatter and body from .agents/skills; the openagents CLI tool; and capability plugin loading with PDK execution.

The acceptance item I could not show earlier — the tool-result loop against a real model — is now shown. The live-execution audit (#89) drove it end to end: the model called shell, ran wc -l, created count.txt, and answered "seed.txt has 4 lines", with the file verified on disk. That is the loop closing, not a registry assertion.

Four defects in this exact code were found by that audit and fixed (c48fa5b138, 0a18c54e6b), and they matter here because each made the tool layer lie:

• output truncation used a byte index into a String, so the first non-ASCII character past 30 kB panicked and killed the agent before its thread could be revoked
• every shell and openagents result was reported to the model as is_error: false, including non-zero exits, timeouts, and a CLI that could not be spawned — a failing build read exactly like a passing one
• the /bin/sh spawn had no process group, so a cancelled fan-out orphaned its commands to init
• the openagents tool ran whatever was on PATH and found nothing on a Rust-only machine; it prefers PATH, falls back to this binary, and names which it used

Each has a test that fails against the old behaviour, verified by reverting the fix.