[pournasserian]

Closes #2509

What

The write tools of F-MCP (#2423) for content types and change sets, on the conventions from #2508. An agent proposes schema changes and submits them, and a person reviews and publishes them.

• Change sets: open_change_set (rationale, sources), submit_change_set (open to checks running) and reopen_change_set (checks failed to open), for the agent's own sets only (Refuse agents' review moves and enforce change set caps #2503).
• Content types: create_content_type (name, slug, definition) and revise_content_type (slug, base version, definition).
  • Each stores the new version, unpublished (Add atomic change set publish #2482), and adds the matching schema operation to a change set in one unit of work, so either both are written or neither is.
  • The set is a change_set_id from open_change_set, or a session_id with a rationale and sources, which opens the session's set on its first call (CHG-02).
• Each write result carries the content type, the change set and a next sentence that says what comes next.
• Core:
  • IChangeSetDirectory.GetSessionSetAsync reads the caller's open set for a session id.
  • IAgentPermissions.CheckChangeSetSizeAsync takes the number of operations a write is about to add.
  • ToolArgumentsReader reads lists of strings, objects, optional ids and required whole numbers.
• CONTRIBUTING.md: the read and write tools and what is live when.

Why

MCP-01 asks for tools for every capability, and the governance model needs everything an agent writes to wait in a change set for a person. With #2482, a stored content type version is not published until its set is. With this PR, every version an agent stores is also in one of its change sets, and no tool approves, rejects or publishes (MCP-06).

Choices worth a look:

• One unit of work for both writes. Each directory finds its expected failures before its own unit of work, so the tool's outer one undoes the version when the change set refuses the operation, for example because of the item's version, a cap or ownership.
• Caps are checked before the write too. A refused cap inside the outer unit of work would roll back its own security event (SEC-08, the limit noted in Refuse agents' review moves and enforce change set caps #2503). The tool therefore first reads the target set and asks IAgentPermissions with the operation it is about to add, or asks for a new set when the session has none. That refusal commits its event, and nothing is stored. The set checks again on the add, which settles a race.
• GetSessionSetAsync is a small read on the change set directory, the one place that knows a session's open set. The pre-check needs it.
• No operation scope yet: an agent with any key can propose. Type, field and operation scopes are the credentials lane's.
• Create and revise of one type in one set is refused by the set (one operation per item), with the set's own message.
• Submit and reopen are separate tools, so each description says exactly when to call it.
• Not in this PR: approve, reject, publish and revert (never for agents), bulk operations with progress and the MCP-01 coverage test (next slice), and entry and entity writes (their lanes).

Tests

Integration, over HTTP:

• On SQLite and PostgreSQL, an agent opens a set, creates category, revises a person's product from version 1 and submits the set. The set holds both operations in order, is in checks running and names the agent, and the tool call log has all four calls, succeeded.
• On SQLite and PostgreSQL, two creates with one session_id land in one set with the first call's rationale.
• On SQLite and PostgreSQL, these store no version, while the agent's own valid create is stored:
  • a definition with an invalid slug, an unknown field type and a bad field name returns every error at once
  • a create past a cap of one item is refused, and agent.items_per_change_set_exceeded stays in the log
  • a create into a person's set and a submit of it are refused as not the agent's own
  • a create without a target names the missing argument
• A revision from a stale base version returns version_conflict with a hint to read the current version, and the type stays at version 2.
• The conformance tests now cover the write tools: names, described schemas with valid examples, and unknown arguments refused before any service is read. Unit tests cover the new reader methods.

The full suite ran locally against a postgres:17 container as well as SQLite, and markdownlint passes. No new package and no new project reference.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers