Harness spec 3.0.0-draft: where each tool is offered; the chat's tools

Every tool says its `sessions` (chat, agent or both). The file tools read, write,
edit, glob, grep and list are shared; mkdir, mv, rm, search, python and the forge
verbs (commit, branch, pr, merge, tag, release) are the chat's; show and recall
are new and shared. New fields: `requires` (page, display, forge) with the exact
`unavailable` answer, and `confirm: always` for merge, tag and release.
knowledge_*, notes_search, note_view and note_manage leave the chat. Default
rules for the new tools; modes.json says what `confirm` does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

harness/permission/defaults.json

@@ -11,6 +11,10 @@
     "glob": "allow",
     "grep": "allow",
     "list": "allow",
+    "search": "allow",
+    "recall": "allow",
+    "show": "allow",
+    "python": "allow",
     "ask_user": "allow",
     "plan_submit": "allow",
     "task": "allow",
@@ -74,6 +78,12 @@
       "tree *-o*": "ask",
       "tree *-R*": "ask",
       "file *-C*": "ask"
-    }
+    },
+    "commit": "ask",
+    "branch": "ask",
+    "pr": "ask",
+    "merge": "ask",
+    "tag": "ask",
+    "release": "ask"
   }
 }

harness/permission/modes.json

@@ -4,6 +4,7 @@
   "order_about": "Loosest first. A project or a subagent may make the mode stricter, never looser; switching to a looser mode is always asked.",
   "aliases": { "unrestricted": "auto" },
   "floor": "The hardline (hardline.json) and the protected paths are refused in every mode, auto included.",
+  "confirm": "Spec 3.0.0: a tool with `confirm: always` (merge, tag, release) is put to the person before it runs, in every mode, auto included, as an approval card naming the call and what it reaches; it runs on a yes only. No rule allows it and no approval is remembered (an approval card offers once, never always). With nobody to answer, it is refused, as unattended says.",
   "modes": {
     "manual": {
       "summary": "Everything not already allowed is asked.",