feat(acp): opt-in profile tool policy for full-capability hosts

[joelbrilliant]

Summary

Add acp.tool_policy so ACP hosts (Buzz, Zed, and other full-capability hosts) can use a Hermes profile's local CLI tool configuration instead of the coding-only hermes-acp default.

• Default remains hermes-acp (editor-compatible, no behaviour change)
• acp.tool_policy: profile resolves tools via the canonical _get_platform_tools path against platform_toolsets.cli (or explicit platform_toolsets.acp when set)
• Same policy on session create and restore
• Host-provided MCP servers cannot expand capability under profile policy
• Dashboard: fold acp.tool_policy into the agent config tab
• Docs: document the knob in the ACP user guide
• No config version bump; deep-merge supplies the default

Why

Remote ACP hosts that attach an existing full Hermes profile need the profile's configured tools (skills, memory, kanban, cron, delegation, …), not the reduced coding toolset. This is generic ACP surface — no host-specific code.

Live dogfood: Buzz Desktop owner-only Rocky DM with full profile tools after setting acp.tool_policy: profile (companion Buzz PR #2633).

Relationship to other open PRs

PR	Overlap	Notes
This PR	Opt-in policy switch: editor default vs full profile	Small, backward compatible
#64045	Honor platform_toolsets.acp always	Complementary; under tool_policy: profile we already honour explicit platform_toolsets.acp, else mirror CLI
#46832	Similar platform_toolsets idea	Covered for profile mode here
#57421	Pass agent.disabled_toolsets	Profile path uses _get_platform_tools, which already applies global disables
#69915	Docs-only Buzz host guide	Orthogonal; this PR documents the config knob on the Hermes side

A deeper first-class product integration with Buzz (beyond ACP stdio) is still best owned by Nous Research if desired later. This PR unblocks full-capability hosts now without breaking editors.

Test plan

• scripts/run_tests.sh tests/acp/test_tool_policy.py -q (13 passed)
• Default / invalid policy still yields hermes-acp + profile MCP
• Profile mode exposes configured CLI toolsets and honours disabled/default-off
• Restored sessions re-apply profile policy
• Host MCP ignored under profile mode
• Buzz owner Rocky dogfood (full tools + multi-turn DM)

[joelbrilliant]

Review request

Opt-in only. Editors keep the coding hermes-acp default with zero behaviour change.

What this adds

acp:
  tool_policy: profile   # full profile tools for remote ACP hosts

• Resolves via _get_platform_tools against platform_toolsets.cli (or explicit platform_toolsets.acp)
• Host MCP cannot expand capability under profile policy
• Dashboard field + ACP user-guide docs

Why
Full-capability ACP hosts (Buzz Desktop dogfood) need the same tools as interactive Hermes for a profile, not the reduced editor toolset.

Live proof
Buzz owner-only Rocky DM with skills/memory/browser/etc after this knob: block/buzz#2633

Related open PRs (complementary, not duplicates)

• feat(acp): honor platform_toolsets.acp config for ACP tool surface #64045 / feat(acp): read platform_toolsets.acp from config #46832 — always honour platform_toolsets.acp (profile mode already does when set)
• fix(acp): pass agent.disabled_toolsets to AIAgent — config-disabled tools stay executable over ACP #57421 — disabled_toolsets passthrough (profile path uses the shared resolver)
• docs(acp): document Buzz host integration #69915 — Buzz host docs only

Happy to adjust naming or defaults if maintainers prefer a different config shape.

[teknium1]

Thanks for making the ACP capability choice opt-in and routing profile mode through the shared resolver. The current-main premise is verified: acp_adapter/session.py:625-628 still hard-codes hermes-acp, and the ACP guide says platform_toolsets.acp cannot narrow that surface (website/docs/user-guide/features/acp.md:275-276).

Problems

• acp_adapter/session.py:209 falls back to hermes-acp when _get_platform_tools() returns an empty list. That defeats the shared resolver's explicit-empty contract (hermes_cli/tools_config.py:2347-2358) and grants the full ACP toolset to a profile that intentionally selected no configurable tools.
• acp_adapter/server.py:819 reloads config to decide MCP admission instead of using the policy that created state.agent. A config change before session/load, session/resume, or session/fork can make host MCP admission disagree with that session's existing tool policy.

Suggested changes

• Preserve an empty resolver result in profile mode; add CLI-empty and ACP-empty policy tests.
• Store the resolved policy on the session/agent and use it for host-MCP admission; test a config change after construction.

This is an automated hermes-sweeper review.