FE-867: tighten agent-extension-host neutrality & witness proofs

Lean on no-imports as the load-bearing neutrality guarantee and drop the
redundant forbidden-substring denylist (a dependency-free module cannot
reference an execute-only or SDK type, so neutrality is structural, not a
name list to maintain).

Make the interview exploration plugin proof bidirectional — its capability
ids must exactly equal Object.keys(createExplorationTools(...)), catching
phantom as well as missing tools. Document that the three native interviewer
tools are covered type-level only (superset) because constructing them needs
a live DB.

Review findings #1 and #2 from ln-review. Zero behavior change.

Amp-Thread-ID: https://ampcode.com/threads/T-019ecb9a-9a08-733b-833d-76885fc8243a
Co-authored-by: Amp <amp@ampcode.com>

Author: kostandinang

src/agent-extension-host.test.ts

@@ -94,30 +94,13 @@ const interviewWitness = {
 } as const satisfies AgentExtensionConsumerWitness;
 
 describe('agent-extension-host contract is a mode-neutral core', () => {
-  it('the contract module is dependency-free and names no execute-only concept', () => {
+  it('the contract module is dependency-free, which is what keeps it mode-neutral', () => {
     const src = readFileSync(join(here, 'agent-extension-host.ts'), 'utf8');
-    // Mode-neutral and SDK-agnostic ⇒ no imports at all.
+    // No imports is the load-bearing guarantee: a module that imports nothing
+    // cannot reference an `execute`-only type (Slice/Epic/Plan/Toolchain/worktree…)
+    // or an SDK type. That makes neutrality structural rather than a denylist of
+    // names we have to remember to update.
     expect(src).not.toMatch(/^\s*import[\s{*]/m);
-    // No `execute`-only domain concepts may leak into the neutral core. Tokens are
-    // checked outside the doc comment so the explanatory prose above can name them.
-    const code = src
-      .split('\n')
-      .filter((line) => !line.trimStart().startsWith('//'))
-      .join('\n');
-    const forbidden = [
-      'Slice',
-      'Epic',
-      'Plan',
-      'TestRunner',
-      'Toolchain',
-      'worktree',
-      'sandboxDir',
-      'pi-coding-agent',
-      'ToolLoopAgent',
-    ];
-    for (const token of forbidden) {
-      expect(code, `neutral core must not mention "${token}"`).not.toContain(token);
-    }
   });
 
   it('a consumer witness only loads plugins of its own mode (per-mode registration)', () => {
@@ -136,14 +119,18 @@ describe('two-consumer proof — both real surfaces fit the host contract', () =
     expect(registered).toEqual(actual);
   });
 
-  it('the interview elicit exploration family matches the real tool surface', () => {
-    // `createExplorationTools` is DB-free, so the exploration capability ids are
-    // proven against live code rather than hardcoded — guarding against drift.
-    const actualExploration = Object.keys(createExplorationTools(here));
-    const registered = new Set(flattenCapabilityIds(interviewWitness));
-    for (const id of actualExploration) {
-      expect(registered.has(id), `witness missing interview tool "${id}"`).toBe(true);
-    }
+  it('the interview exploration plugin matches the real tool surface exactly', () => {
+    // `createExplorationTools` is DB-free, so this family is proven bidirectionally
+    // against live code: the witness may neither omit a real tool nor invent a
+    // phantom one. The three native interviewer tools (ask_question /
+    // present_preface / propose_phase_closure) can't be checked this way —
+    // constructing them needs a live DB — so their coverage is type-level only
+    // (the `keyof InterviewerTools` assertion below), which is superset-only: it
+    // proves the witness omits no real tool, not that it invents none.
+    const explorationPlugin = interviewWitness.plugins.find((p) => p.id === 'elicit.workspace-exploration');
+    const witnessed = new Set(explorationPlugin?.capabilities.map((c) => c.id));
+    const actual = new Set(Object.keys(createExplorationTools(here)));
+    expect(witnessed).toEqual(actual);
   });
 
   it('the interview witness covers every interviewer tool id (type-enforced under lint --type-check)', () => {