[Models] toolMode 'auto' does not resolve tools against scope.resources (only caller-supplied toolHandlers) — #510 criterion, untracked

Part of #510. Splitting out the one remaining **unchecked and untracked** acceptance criterion so it isn't lost behind a stale code breadcrumb.

## The gap

#510's criterion — *"Tool calls work in both `'return'` and `'auto'` modes; `'auto'` resolves against `scope.resources`"* — is only **half** met:

- **Shipped** (#612 / #848): `toolMode: 'auto'` runs the agent loop, dispatching model tool-calls against a **caller-supplied `opts.toolHandlers` table**.
- **Not built:** `'auto'` resolving a tool-call against **`scope.resources`** — i.e. a model tool-call named for a registered Resource is dispatched to that Resource automatically, with no caller-wired handler.

## Stale breadcrumb (why this was invisible)

`resources/models/agentLoop.ts` documents the future work against **#615**:

- `agentLoop.ts:51-52` — *"Registry seam: v1 dispatches via caller-supplied `opts.toolHandlers`. #615 replaces that lookup with a `scope.resources` resolution using the same call signature…"*
- `agentLoop.ts:393` — *"(#615 swaps this lookup for a `scope.resources` registry…)"*

But **#615 is closed/completed** and is about the *MCP tool registry + RBAC `tools/list` filtering* — unrelated to `scope.models` auto-resolution. So the criterion has no live tracking issue. This one is it; the `agentLoop.ts` comments should be repointed here.

## Scope (to be refined in a design note first)

Design-review-first per engineering guidelines — this adds a new dispatch surface:

- **Resolution:** how a tool-call name maps to a `scope.resources` entry and which method it invokes.
- **Precedence:** how `scope.resources` resolution composes with an explicit `opts.toolHandlers` (caller handler wins? falls through?).
- **RBAC:** permission enforcement on the auto-dispatched Resource call (must not become an auth bypass — dispatch under the request's user/permissions).
- **Relationship to MCP:** the ops-MCP wrapper (#465, closed) and MCP tool resolution — whether MCP-exposed tools resolve through the same seam.

## Acceptance

- [ ] An `'auto'` `generate`/`generateStream` with `tools[]` declared and **no** `toolHandlers` supplied resolves a model tool-call to a registered Resource, invokes it under the caller's permissions, and feeds the result back into the loop.
- [ ] Precedence with `toolHandlers` is defined and tested.
- [ ] `agentLoop.ts` comments repointed from #615 to this issue.

## Refs

- Tracking: #510 (last unchecked feature criterion)
- Superseded breadcrumb: #615 (closed, MCP tool registry — not this)

---
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start with the design note and resources/models/agentLoop.ts, especially the registry comments at lines 51-52 and 393. Define resource resolution, handler precedence, permissions, and the MCP relationship before implementation. Done means the acceptance cases for generate and generateStream are tested, including caller permissions and repointed comments.

Written by the indexing model from the issue text.