feat(FN-3956): execute provisioning on approval decisions

The merge completes Step 1 of agent provisioning approval followthrough, executing provisioning actions when approval decisions are made, with supporting documentation in AGENTS.md and docs/agents.md. Test coverage spans provisioning policy, approval routes, gating classifications, extension integra

Fusion-Task-Id: FN-3956

packages/engine/src/__tests__/gating-classifications-provisioning.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import {
+  ACTION_GATE_TASK_AGENT_MANAGEMENT_TOOLS,
+  PERMANENT_AGENT_TASK_MUTATION_TOOLS,
+  TASK_AGENT_MUTATION_TOOLS,
+} from "../gating-classifications.js";
+
+describe("gating classifications provisioning split", () => {
+  it("keeps provisioning tools out of action-gate set", () => {
+    expect(ACTION_GATE_TASK_AGENT_MANAGEMENT_TOOLS.has("fn_agent_create")).toBe(false);
+    expect(ACTION_GATE_TASK_AGENT_MANAGEMENT_TOOLS.has("fn_agent_delete")).toBe(false);
+  });
+
+  it("retains provisioning tools in permanent/task mutation sets", () => {
+    expect(PERMANENT_AGENT_TASK_MUTATION_TOOLS.has("fn_agent_create")).toBe(true);
+    expect(PERMANENT_AGENT_TASK_MUTATION_TOOLS.has("fn_agent_delete")).toBe(true);
+    expect(TASK_AGENT_MUTATION_TOOLS.has("fn_agent_create")).toBe(true);
+    expect(TASK_AGENT_MUTATION_TOOLS.has("fn_agent_delete")).toBe(true);
+  });
+});

packages/engine/src/index.ts

@@ -11,6 +11,7 @@ export {
   taskDocumentReadParams,
   taskDocumentWriteParams,
   taskLogParams,
+  executeApprovedAgentProvisioning,
 } from "./agent-tools.js";
 export { AgentSemaphore, PRIORITY_MERGE, PRIORITY_EXECUTE, PRIORITY_SPECIFY } from "./concurrency.js";
 export { TriageProcessor, type TriageProcessorOptions } from "./triage.js";