[Core] Allow extension-owned Loops to call same-extension tools #501

Summary

A globally installed and enabled extension can contribute both a Loop and executable tools. The Loop validates and compiles, but daemon execution currently resolves its actions through the regular session-visible tool projection. With the default external-source policy, the extension tool is hidden and the action fails as unknown_action_kind even though both resources have the same trusted extension owner.

Example

An extension named release-automation contributes:

• Loop release-flow
• Tool ext__release_automation__prepare

release-flow should be able to call its own prepare tool without requiring the operator to enable every external source globally. A tool contributed by a different extension must remain governed by the normal policy.

Expected contract

• Preserve the trusted extension owner from the resource catalog through compilation and the run-owned executed-definition snapshot.
• During daemon execution, grant only the exact extension source that owns the Loop.
• Keep foreign extension, MCP, dynamic, and unrelated external sources governed by the existing policy.
• Continue enforcing descriptor availability, permissions, risk, schema pinning, and implementation drift checks.
• Preserve the same behavior after daemon restart and run hydration.

Acceptance criteria

• Extension provenance round-trips from contributed resource to executed-definition snapshot and hydration.
• A Loop contributed by extension X resolves and calls a tool contributed by extension X under the default external-source policy.
• The same Loop cannot resolve a tool contributed by extension Y unless normal policy allows it.
• Bundled and development-link behavior remains unchanged.
• Missing, disabled, unavailable, schema-drifted, or unauthorized tools still fail with the existing structured reasons.
• Regression coverage exercises the real Loop action registry and runtime tool policy path.

Security boundary

This is an exact same-owner capability, not a blanket external_default = enabled change. The extension owner must come from daemon-trusted resource metadata and must not be author-controlled Loop YAML.