Remove Codebox runtime tool policy leakage

[chubes4]

Summary

• Remove the legacy wp-codebox/sandbox-tool-policy/v1 transport alias from host tool policy normalization.
• Use the neutral agents-api/runtime-tool-policy/v1 transport schema for list-shaped runtime tool policy payloads.
• Add a production inc/ boundary guard against Codebox vocabulary while keeping the broader downstream vocabulary smoke intact.

Tests

• php tests/pipeline-tool-policy-snapshot-smoke.php
• php tests/boundary-forbidden-names-smoke.php

AI assistance

• AI assistance: Yes
• Tool(s): openai/gpt-5.5 via opencode
• Used for: Implementing the production policy cleanup, updating smoke coverage, running targeted verification, and drafting this PR description.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

Deep dive: homeboy lint data-machine --changed-since 8422fe6

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-lint-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-lint-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/27922304254

Test

✅ test — passed

ℹ️ No impacted tests found for --changed-since 8422fe6
ℹ️ Run full suite if needed: homeboy test data-machine
Deep dive: homeboy test data-machine --changed-since 8422fe6

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-test-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-test-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/27922304254

Audit

✅ audit — passed

Deep dive: homeboy audit data-machine --changed-since 8422fe6

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-audit-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-audit-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/27922304254

Tooling versions

• Homeboy CLI: homeboy 0.249.0+f05a14e58a41+0942e995
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: f369690a
• Action: unknown@unknown