Feature request: Support user-invocable-only canvases

Summary

Add a canvas visibility/invocation setting that allows extension authors to expose a canvas to users without making it discoverable or invocable by the agent.

Problem

User-scoped canvases are registered with every applicable session. Their declarations become available to the agent, which:

• Allows the agent to open the canvas without an explicit user request.
• Adds canvas metadata to the model's input context.
• Prevents authors from building strictly user-initiated utilities.
• Creates unnecessary token overhead for canvases that are rarely used.

Omitting actions prevents action invocation but does not prevent agent discovery or opening.

Proposed API

createCanvas({
  id: "example",
  displayName: "Example",
  description: "An explicitly opened utility.",
  invocation: {
    user: true,
    agent: false,
  },
  open: async (context) => {
    // ...
  },
});

A simpler alternative:

agentInvocable: false

Expected behavior

When agentInvocable is false:

• The canvas remains visible in user-facing canvas discovery and commands.
• Users can open it explicitly.
• Its declaration and action schemas are excluded from model context.
• open_canvas and invoke_canvas_action cannot target it.
• Canvas-internal, app-only tools continue to work.
• The default remains agent-invocable for backward compatibility.

Acceptance criteria

• Extension authors can independently configure user and agent invocation.
• User-only canvases consume no model-context tokens before explicit use.
• Agent attempts to invoke user-only canvases fail with a clear authorization error.
• Invocation restrictions are enforced by the host, not only through instructions.
• The setting works for user-, project-, and session-scoped extensions.
• Existing canvas extensions retain their current behavior.

Motivation

This would enable dashboards, editors, configuration panels, and other interactive utilities that should be available on demand without permanently expanding every agent session's tool surface.

该 issue 提到了 createCanvas、open_canvas 和 invoke_canvas_action，但没有文件或测试。首先定位这些入口点，并跟踪 canvas 声明如何进入模型上下文，以及 host 调用如何获得授权。完成的标准是：仅供用户使用的 canvas 仍可被用户发现，被排除在模型上下文之外，明确拒绝 agent 调用，并保留现有默认值。