feat(capabilities): task workspaces + tools allowlist plumbing (#20)

- task schema: optional workspace (absent | :run ephemeral | named
  persistent under dataRoot/workspaces) and capabilities.tools (pi
  documented tool allowlist); strict validation, traversal-proof names
- runner: creates host workspace, passes MOSAIC_WORKSPACE (container
  path) + MOSAIC_TOOLS; result.json records both
- pi adapter: cds into workspace; --tools when allowlist present else
  --no-tools
- mock adapter: logs delivered MOSAIC_* vars to stderr as deterministic
  plumbing evidence (dash prints 'export K=v', so use env not export)

Closes #20

adapters/pi/adapter.sh

@@ -12,11 +12,21 @@ set -eu
 : "${PI_PROVIDER:?pi adapter: PI_PROVIDER is required}"
 : "${PI_MODEL:?pi adapter: PI_MODEL is required}"
 
+# Workspace (M5): run inside the provided workspace when present.
+if [ -n "${MOSAIC_WORKSPACE:-}" ]; then
+    mkdir -p "$MOSAIC_WORKSPACE"
+    cd "$MOSAIC_WORKSPACE"
+fi
+
+# Capabilities (M5): explicit allowlist or no tools.
+TOOLS_FLAG="--no-tools"
+[ -n "${MOSAIC_TOOLS:-}" ] && TOOLS_FLAG="--tools $MOSAIC_TOOLS"
+
 # All flags documented in the pi package README (CLI Reference):
 #   -p/--print     noninteractive: print the response and exit
 #   --system-prompt  replace the default prompt with the generated one
 #   --no-*         no ambient context/skills/extensions/templates/themes
-#   --no-session   ephemeral; --no-tools  this runtime needs no tools
+#   --no-session   ephemeral; TOOLS_FLAG per capabilities
 #   --offline      no startup network operations (update checks/telemetry)
 exec pi \
     --offline \
@@ -26,7 +36,7 @@ exec pi \
     --no-prompt-templates \
     --no-themes \
     --no-context-files \
-    --no-tools \
+    $TOOLS_FLAG \
     --provider "$PI_PROVIDER" \
     --model "$PI_MODEL" \
     --system-prompt "$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")" \