feat: integrate authorized Worker Drive operations

Merge approved T-723 source e94af40d into develop3a2994cd. Resolve overlapping configuration WIP test migration by retaining source typed result assertions and target live Tree/Inspect publication checks. Runtime implementation merged without conflicts. Root check; full Manifest, Tools, Worker935+110, Runtime349+34, Server710+11, FS and Workdir suites; Workdir HTTP; API83/TypeScript91; WIP0.2.0 resolution and fmt/diff checks passed.

resources/config-schema/profile-authoring.dcdl

@@ -40,7 +40,7 @@ let
             task = Flag; web = Flag; image = Flag; sub_worker = Flag; flow = Flag;
             worker = { enabled = Bool; direct_spawn = Bool; };
             workspace_worker_discovery = Flag; objective = Flag; manage_workdir = Flag;
-            workdir_catalog = Flag; workspace_config = Flag; orchestration = Flag;
+            workdir_catalog = Flag; workspace_config = Flag; drive = Flag; orchestration = Flag;
             ticket = { enabled = Bool; authoring = Bool; thread = Bool; intake = Bool; workflow = Bool; };
             merge_request = { show = Bool; open = Bool; review = Bool; readiness_check = Bool; complete = Bool; };
             memory = {

resources/profiles/backend-job.dcdl

@@ -10,6 +10,7 @@ import "./base.dcdl" // {
     };
 
     feature = {
+        drive = { enabled = false; };
         task = { enabled = false; };
         memory = { enabled = false; };
         subjektiv = { enabled = false; extraction = { enabled = false; }; };

resources/profiles/base.dcdl

@@ -25,6 +25,8 @@ compaction = {
 };
 
 feature = {
+    # Activation only; Backend Drive grants remain independent.
+    drive = { enabled = false; };
     task = { enabled = true; };
     memory = { enabled = false; staging_tools = false; };
     subjektiv = {

resources/profiles/coder.dcdl

@@ -9,6 +9,7 @@ import "./base.dcdl" // {
     };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/companion.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     model = { ref = "codex-oauth/gpt-6-astra"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/default.dcdl

@@ -5,6 +5,8 @@ import "./base.dcdl" // {
     delegation_scope = "workspace_write";
 
     feature = {
+        # Activation only; Backend Drive grants remain independent.
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; staging_tools = false; };
         subjektiv = { enabled = false; extraction = { enabled = false; }; };

resources/profiles/intake.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     engine = { instruction = "role.intake"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/job.dcdl

@@ -9,6 +9,7 @@ engine = {
 };
 session = { record_event_trace = false; };
 feature = {
+    drive = { enabled = false; };
     task = { enabled = false; };
     memory = { enabled = false; staging_tools = false; };
     subjektiv = { enabled = false; consolidation_tools = false; extraction = { enabled = false; }; };

resources/profiles/orchestrator.dcdl

@@ -5,6 +5,7 @@ import "./base.dcdl" // {
     engine = { instruction = "role.orchestrator"; };
 
     feature = {
+        drive = { enabled = true; };
         task = { enabled = true; };
         memory = { enabled = false; };
         subjektiv = { enabled = true; };

resources/profiles/standalone.dcdl

@@ -2,6 +2,7 @@ import "./default.dcdl" // {
     slug = "standalone";
     description = "Standalone Yoi coding profile.";
     model = { ref = "codex-oauth/gpt-6.1-sol"; };
+    feature = { drive = { enabled = false; }; };
     scope = {
         intent = "workspace_write";
         symlink_policy = "logical";

resources/prompts/catalog.dcdl

@@ -6,6 +6,7 @@ let
 defaultDocument = import "./default.md";
 commonLanguage = import "./common/language.md";
 commonGit = import "./common/git.md";
+commonDrive = import "./common/drive.md";
 commonMergeRequest = import "./common/merge-request.md";
 commonTickets = import "./common/tickets.md";
 commonToolUsage = import "./common/tool-usage.md";
@@ -44,6 +45,7 @@ in
     default_prompt = defaultDocument.content;
     common = {
         git = commonGit.content;
+        drive = commonDrive.content;
         language = commonLanguage.content;
         merge_request = commonMergeRequest.content;
         tickets = commonTickets.content;

resources/prompts/common/drive.md

@@ -0,0 +1,7 @@
+## Workspace Drive
+
+Drive is Backend-owned workspace storage, not a Workdir or a host filesystem path. Feature/Profile activation is not a grant; every operation is checked by the Backend. Use the exposed Drive tools or the native WIP `/drive` entry with bounded listing and reading. Do not enumerate a Drive tree or infer authority from a visible reference.
+
+Observe an entry before replacing or deleting it; the host/client carries its revision precondition. On conflict, reread and reconcile rather than overwriting blindly. On `OutcomeUnknown`, retain the request ID and query request status before another mutation: the operation may have committed. Save a Workdir file into Drive only through a current scoped attachment using its logical relative source path; saving does not attach a Workdir or grant file access.
+
+Internal SubWorkers currently have no explicit Backend Drive grant mechanism. They must not inherit Drive access through a parent's shared WorkspaceClient, even with an enabled or inherited Profile. Ask the authorized parent to perform the operation instead.