fix(toolintent): key the read-before-write exemption on content provenance, not parameter shape

The exemption added in 6a8a7b31 was broader than the invariant it stood on. "Tool
declares a SOURCE_PATH" is a claim about the parameter list; the safe property is
"every byte written derives from an existing source object rather than from
model-supplied content". A future transform or import tool could name a source and
still write model-controlled output, and would have inherited the exemption.

ToolCapability.CONTENT_FROM_SOURCE now carries that provenance claim explicitly.
file_copy declares it; ReadBeforeWriteRule.appliesTo stands down only for calls that
do, so ToolCallAssessor skips the rule rather than the rule skipping itself. The
capability is recorded on the invocation event like every other one, so replay
classifies a call by what it actually claimed instead of re-deriving it from
parameters.

Tool availability is by declared tool name, not capability-set containment, so the
extra capability does not narrow which stages can reach file_copy.

Tests: the exemption is asserted through ToolCallAssessor, plus a source-naming tool
WITHOUT the provenance capability that stays gated. ./gradlew check green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/events/AGENTS.md

@@ -22,6 +22,7 @@ CORREX kernel team. This is the most cross-cutting module in the codebase — ch
 - Domain event files: `ApprovalEvents`, `ArtifactEvents`, `ContextEvents`, `InferenceEvents`, `OrchestrationEvents`, `RouterEvents`, `SessionEvents`, `TaskEvents`, `ToolEvents`, `IntentEvents`, `RiskAssessedEvent`, `JournalCompactedEvent`, and many more — all payload definitions live here.
 - `FailureAttribution` / `FailureAttributor` — the terminal-failure taxonomy (`AGENT`, `HARNESS`, `WORKFLOW`, `ENVIRONMENT`, `PROVIDER`, `OPERATOR`, `UNKNOWN`) carried as `WorkflowFailedEvent.attribution`, plus the deterministic reason→layer mapping used both at emission and when classifying historical events. One primary attribution per terminal event; a multi-cause chain is the session's `FailureTicketOpenedEvent`s, not a second structure.
 - `LspDiagnosticsCompletedEvent` records pulled language-server diagnostics or a graceful skip reason; replay consumes this observation and never contacts the server.
+- `ToolCapability.CONTENT_FROM_SOURCE` — content-provenance claim: the bytes a call writes derive entirely from an existing source object it names, never from model output. Recorded on the invocation event like every other capability, so replay classifies the call by what it actually claimed. Only declare it on a tool whose output is a faithful reproduction of its source.
 - Shared vocabulary: `IdentityTypes` (SessionId, TaskId, etc.), `Tier`, `TokenUsage`, `ToolReceipt`, `ToolRequest`, `RiskLevel`, `RetryPolicy`, `GrantScope`, `GrantLedger`.
 
 ## Work Guidance

core/events/src/main/kotlin/com/correx/core/tools/contract/ToolCapability.kt

@@ -23,6 +23,18 @@ enum class ToolCapability {
      */
     DIRECTORY_LIST,
     FILE_WRITE,
+
+    /**
+     * Content provenance: every byte this call writes is derived from an existing source object the
+     * call names (a file on disk, a stored artifact), never from model-supplied content. It is a
+     * claim about WHERE the bytes come from, not about the shape of the parameter list — a transform
+     * or import tool that mixes in model-authored output must NOT declare it.
+     *
+     * Carried alongside [FILE_WRITE] (such a call still mutates the filesystem) so the gates that
+     * exist to stop a model writing from memory can stand down: requiring a prior `file_read` of a
+     * copied file's bytes is unsatisfiable for a binary and defeats the point of copying it.
+     */
+    CONTENT_FROM_SOURCE,
     NETWORK_ACCESS,
     SHELL_EXEC,
     PROCESS_SPAWN,