feat: expose authorized Worker Drive tools and native WIP entries

Use T-722 identity-bound API for paged discovery, bounded text read/create/write/edit, folders, relocate/delete, revision-fixed images, Workdir artifact publication, and mutation receipts. Keep IDs as Workspace-bound decimal strings, observed CAS preconditions and Client validators hidden from model arguments, and never substitute revisions or blindly replay uncertain effects.

Activate via host-bound Feature/Profile/schema and centralized instructions. Publish only the Drive entrance as indexable; resolve selected stable IDs directly with coherent self-scoped WIP publication. Internal SubWorkers and Reviewer children deny undelegated Drive access at feature and client boundaries; no child grant or local storage authority is synthesized.

T-723 validation: root cargo check; manifest 190; tools 78 unit +39 integration +1 doctest; Worker 918 unit +110 integration; Runtime 348 unit +34 binary; Server 708 library +11 binary including 17 real DB+LocalFileSystem signed-API adapter tests. Native image capture/replay, multichunk revision bounds, Workdir import, concurrent CAS, current grants, response-loss reconciliation and dependent config WIP0.2 regressions pass. WIP crates.io 0.2.0 resolution verifier, fmt and diff checks pass.

resources/profiles/backend-job.dcdl

@@ -10,6 +10,7 @@ import "./base.dcdl" // {
     };
 
     feature = {
+        drive = { enabled = false; };
         task = { enabled = false; };
         memory = { enabled = false; };
         subjektiv = { enabled = false; extraction = { enabled = false; }; };

resources/profiles/base.dcdl

@@ -25,6 +25,8 @@ compaction = {
 };
 
 feature = {
+    # Activation only; Backend Drive grants remain independent.
+    drive = { enabled = false; };
     task = { enabled = true; };
     memory = { enabled = false; staging_tools = false; };
     subjektiv = {

resources/profiles/coder.dcdl

@@ -9,6 +9,7 @@ import "./base.dcdl" // {
     };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/companion.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     model = { ref = "codex-oauth/gpt-6-astra"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/default.dcdl

@@ -5,6 +5,8 @@ import "./base.dcdl" // {
     delegation_scope = "workspace_write";
 
     feature = {
+        # Activation only; Backend Drive grants remain independent.
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; staging_tools = false; };
         subjektiv = { enabled = false; extraction = { enabled = false; }; };

resources/profiles/intake.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     engine = { instruction = "role.intake"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/job.dcdl

@@ -9,6 +9,7 @@ engine = {
 };
 session = { record_event_trace = false; };
 feature = {
+    drive = { enabled = false; };
     task = { enabled = false; };
     memory = { enabled = false; staging_tools = false; };
     subjektiv = { enabled = false; consolidation_tools = false; extraction = { enabled = false; }; };

resources/profiles/orchestrator.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     engine = { instruction = "role.orchestrator"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/standalone.dcdl

@@ -2,6 +2,7 @@ import "./default.dcdl" // {
     slug = "standalone";
     description = "Standalone Yoi coding profile.";
     model = { ref = "codex-oauth/gpt-6.1-sol"; };
+    feature = { drive = { enabled = false; }; };
     scope = {
         intent = "workspace_write";
         symlink_policy = "logical";