Remote-safe: AI agent & automation read tools

[mocha06]

Closes #437. Part of migrating the default-deny remote profile to expose the read tools that meet the remote-safe criteria (milestone: Hosted-safe tool surface). Stacked on dev.

Motivation

Under --profile remote the server exposes only tools carrying meta=REMOTE (tracked by REMOTE_SEED); many pure read tools that reach the API with the request-scoped bearer and are fully governed by API permissions were still withheld. This exposes the AI agent and AI automation read/log surface.

Outcome

Marks 11 AI agent & automation read tools remote-safe: get_ai_agent, get_ai_agents, get_ai_agent_logs, get_ai_agent_log_details, get_agents_usage, validate_ai_agent_behaviors, get_ai_automation, get_ai_automations, validate_ai_automation_prompt, get_ai_credit_usage, get_available_ai_models. Each tool carries meta=REMOTE and a matching REMOTE_SEED entry; the drift-guard test keeps the two in lockstep. No new tools, no behavior change under the local profile.

Remote-profile validation

The remote-safe read migration (this PR is part of the stack #437→#441) was verified end-to-end by running the code in --profile remote --transport http locally — behaving as a deployed instance — and connecting an MCP HTTP client with a valid RS256 Keycloak bearer. Measured on an integration branch that also carried the in-flight provider-write work (#434), so the withheld count includes those write tools:

#	Scenario	Observed	Verdict
1	Server in --profile remote --transport http	exposed 76, withheld 106 (default-deny)	✅
2	Unauthenticated request	401 (bearer required)	✅
3	tools/list with a valid RS256 bearer	exactly the 76 remote-safe tools	✅
4	Remote-safe reads present	get_organization, get_pipe, get_llm_providers, get_ai_agents	✅
5	Writes / local-file / raw GraphQL withheld	create_card, create_llm_provider, delete_card, upload_attachment_to_card, execute_graphql absent — 0 leaked	✅
6	Live authenticated tool call (per-request bearer → outbound)	get_organization executed (isError=false)	✅

The 76 remote-safe tools are the 23 pre-existing plus the 53 read tools this migration set (#437–#441) adds. Registration-time filtering is also covered by the test_remote_profile.py drift-guard and test_on_exposes_seed_and_withholds_the_rest.

[adriannoes]

Summary

Marker-only change that meets #437: the 11 AI agent and automation read/validate tools get meta=REMOTE with matching REMOTE_SEED entries, and the drift-guard stays in lockstep. Local checkout on tip 3273efe ran the remote-profile tests and the full MCP non-integration suite green; CI lint and test are also green. No behavior change under the local profile.

What worked well

• Markers and seed updated together with a clear #437 comment; writes in the same modules stay unmarked.
• Stack hygiene is visible in the hunk: get_available_ai_models lands here, while org provider discovery stays for the next slice.
• The PR body correctly notes that the E2E "76 exposed" table is end-of-stack (and may include #434 on the measurement branch), not this tip alone (tip seed is baseline plus these 11).

Review path

• Checked out the PR tip, ran ruff on touched files, test_remote_profile.py, and the MCP unit suite; verified marker/seed lockstep (11 == 11).
• Cross-checked sibling stack reviews (#444 to #447) and independent tracks (#434, #436): same chore shape, nothing to absorb as a finding here.
• Fan-out on validate_ai_agent_behaviors is pre-existing and capped; quotas belong under #309, not as a gate for this allowlist.

Merge this before the stacked follow-ons (#444 to #447) so the bases stay linear.