feat: complete WorkBuddy parity and Windows release workflow

src/main/capabilities/runtime.ts

@@ -8,6 +8,10 @@ import type { AgentMode } from '@shared/conversation'
 
 export interface CapabilityToolSnapshot {
   specs: ToolSpec[]
+  /** Host-enforced subsets, e.g. a bounded child worker. Applied to built-in tools too. */
+  filterSpecs?(specs: ToolSpec[]): ToolSpec[]
+  aroundExecute?(name: string, args: Record<string, unknown>, ctx: ConversationToolContext,
+    execute: () => Promise<ConversationToolResult>): Promise<ConversationToolResult>
   metadata?(name: string): Record<string, unknown> | undefined
   execute(name: string, args: Record<string, unknown>, ctx: ConversationToolContext): Promise<ConversationToolResult | undefined>
 }