…ag registry)

Add an opt-in `script` tool (TSFORGE_SCRIPT=1) that lets the model write ONE
TypeScript program calling tools through generated `./tsforge-tools` stubs,
collapsing a mechanical multi-step tool chain into a single model turn. Only the
script's stdout returns to the model — intermediate results never enter context.

Mechanism: doScript writes the stub module + the model's code to a temp dir,
starts a loopback RPC server (Bun.serve on 127.0.0.1, one-time token), and runs
`bun run script.ts`. Each stub call POSTs {tool,args} back to the server, which
dispatches through the EXISTING executeTool chokepoint — so scope, the unified
policy, the write-guard, mutation accounting, and the gate all still apply. The
model gains ergonomics, not new powers (same trust level as `run`).

Bounded by a wall-clock timeout (kill), a per-script tool-call cap, and output
condensing. The RPC subset excludes the scaffolds, the dependency installer,
yield, and `script` itself (no recursion); requests are token-gated and
serialized so concurrent stub calls can't interleave a mutation. Not advertised
in plan mode and rejected at dispatch there, so the "no writes while planning"
guarantee holds.

Also introduces TOOL_SPECS in agent.constants.ts — one source of truth for
per-tool flags (readOnly, scriptExposable) that READ_ONLY_TOOL_NAMES and the
script-exposable subset now derive from, replacing hand-kept sets.

Tests: 15 new (stub generation, single-turn batching + call accounting, real
in/out-of-scope writes through executeTool, plan-mode rejection, call cap,
timeout kill, token/recursion/non-exposable guards, serialization, registry
equivalence). Full `bun run validate` green (1616 pass).

Eval validation (A/B: TSFORGE_SCRIPT off vs on, TTSR + token cost at
equal-or-better gate pass-rate) to follow — the feature ships only if the sweep
shows a real, non-regressing cost reduction.

…s (PR #50 review)

Two critical issues from Gemini review:

1. The script ran from a temp dir under the system tmpdir, so a script importing
   a project dependency (zod, etc.) failed module resolution, and the dir leaked
   if startRpcServer threw before the try block. Create the temp dir inside
   ctx.cwd (hidden .tsforge-script-* prefix so eslint/tsc ignore it) so Node/Bun
   resolution walks up to the workspace node_modules + relative imports, and move
   the server start inside try so the dir is always cleaned up.

2. runToolCalls tracked a single wrote.path, overwritten per edit/create event —
   so a script that writes N files only recorded the LAST in touched and only
   write-guarded that one; the rest bypassed the write-guard and change-scoped
   rules (test-sibling-required). Collect ALL written in-scope paths in a Set and
   recordTouched + write-guard each.

Tests: script resolves a workspace node_modules dep; a 3-file script records all
three in touched (state.edits=3) and leaves no temp dir behind. validate green
(1618 pass).