Feature request: Support user-invocable-only canvases

### Summary

Add a canvas visibility/invocation setting that allows extension authors to expose a canvas to users without making it discoverable or invocable by the agent.

### Problem

User-scoped canvases are registered with every applicable session. Their declarations become available to the agent, which:

- Allows the agent to open the canvas without an explicit user request.
- Adds canvas metadata to the model's input context.
- Prevents authors from building strictly user-initiated utilities.
- Creates unnecessary token overhead for canvases that are rarely used.

Omitting `actions` prevents action invocation but does not prevent agent discovery or opening.

### Proposed API

```js
createCanvas({
id: "example",
displayName: "Example",
description: "An explicitly opened utility.",
invocation: {
user: true,
agent: false,
},
open: async (context) => {
// ...
},
});
```

A simpler alternative:

```js
agentInvocable: false
```

### Expected behavior

When `agentInvocable` is `false`:

- The canvas remains visible in user-facing canvas discovery and commands.
- Users can open it explicitly.
- Its declaration and action schemas are excluded from model context.
- `open_canvas` and `invoke_canvas_action` cannot target it.
- Canvas-internal, app-only tools continue to work.
- The default remains agent-invocable for backward compatibility.

### Acceptance criteria

- Extension authors can independently configure user and agent invocation.
- User-only canvases consume no model-context tokens before explicit use.
- Agent attempts to invoke user-only canvases fail with a clear authorization error.
- Invocation restrictions are enforced by the host, not only through instructions.
- The setting works for user-, project-, and session-scoped extensions.
- Existing canvas extensions retain their current behavior.

### Motivation

This would enable dashboards, editors, configuration panels, and other interactive utilities that should be available on demand without permanently expanding every agent session's tool surface.

Issue では createCanvas、open_canvas、invoke_canvas_action が挙げられていますが、ファイルやテストはありません。まずこれらのエントリーポイントを見つけ、canvas の宣言がどのようにモデルコンテキストに到達するか、またホストによる呼び出しがどのように認可されるかを追跡してください。ユーザー専用の canvas が引き続きユーザーから発見可能であり、モデルコンテキストから除外され、エージェントからの呼び出しを明確に拒否し、既存のデフォルトを維持できれば完了です。

索引モデルが issue の本文から書いたものです。