feat(platform): implement delegated Connection Tool Gateway

## Problem

Agent Platform needs a separately reviewable security boundary for Runtime tool calls so main conversations can proceed with a Fake Connection while real Connection evolves independently.

## Scope

- Implement Platform Tool Gateway routes and internal client using the versioned delegated contract.
- Verify Execution Grant signature, issuer, audience, expiry, grant ID, Agent/user/Conversation/Execution/Action bindings, and current Platform authorization before every call.
- Resolve user, Agent, allowed Action set, and delegated context server-side; reject caller-supplied user/Connection/account/revision selectors.
- Call a schema-conformant Fake Connection, map redacted results/errors, persist `callId` references/audit, and preserve actual success/failure/unknown outcomes.
- Add consumer contract tests intended for the independent Connection implementation.
- Own the Platform-side real HTTP delegated client and policy-fence registration/termination/synchronization needed by the same Gateway, using only #398 published wire schemas and the existing Platform transaction/outbox boundary. Stop assertion issuance and close affected routes before revocation; persist retryable fence synchronization, and resume only after the matching revision is acknowledged. Connection-side authorization, persistence and dispatch remain with its existing implementation Issues.
- Keep the schema-conformant Fake as the deterministic L1 boundary, while the real client consumes exactly the same generated contract and consumer tests; no second Gateway, issuer, DTO authority or Connection Grant store.
- Do not implement Connection Principal, OAuth, credential, Provider, Action executor, or GitHub logic.

## Acceptance criteria

- [ ] **AC-1:** Every Tool call validates the current Execution Grant and current Platform authorization before delegated side effects.
- [ ] **AC-2:** Runtime can submit only Action ID and schema-valid arguments; identity, Connection, external account, credential, and authorization revisions remain server-resolved.
- [ ] **AC-3:** Fake delegated calls persist trace/execution/call correlation and expose only redacted result/error projections.
- [ ] **AC-4:** Authorization loss, Action removal, bad audience, stale grant, cross-Agent replay, duplicate request, and unknown result fail or recover without duplicate side effects.
- [ ] **AC-5:** Published consumer tests can be run unchanged by the real Connection implementation.

- [ ] **AC-6:** The Platform-side real HTTP client and policy-fence synchronization use #398 versioned schemas, validate authenticated peer/current revision, persist retryable synchronization, and fail closed on unavailable Connection or missing/stale acknowledgement. Revocation stops issuance before synchronization; retries cannot resurrect stale policy or duplicate delegated effects.

## Validation

- Run focused grant, current-authorization, delegated contract, Fake Connection, idempotency, audit, and attack tests.
- Run the complete repository validation sequence in `AGENTS.md`.

## Blocked by

- #252
- #275
- #276
- #277
- #278
- #285
- #286
- #287
- #288
- #320
- #398

## Scope decision

2026-09-09: #150 coordinator decision retains #186 as the sole Platform policy/assertion/callId/Gateway implementation owner and includes the necessary real HTTP/fence-command increment here. This is a scope clarification under the user delegation for #144; #398 remains the native blocker and sole wire-contract authority. Implementation waits for that contract and applicable consumer review; no Connection-side implementation is claimed or reassigned.