[codex] Collapse Summon to Arrow-only tool runtime

[nahiyankhan]

Summary

• Collapse Summon generation to Arrow-only artifacts with host-owned SurfacePolicy and derived SurfacePlan diagnostics.
• Rename public intent/capability vocabulary to tool vocabulary across APIs, protocol messages, Devtools events, demos, docs, tests, and public package manifests.
• Remove legacy section/fragment/script/runtime controls, v3 intent-shaped envelopes, TrustedFixtureSurface, and raw scripted demo fixtures.
• Rebuild adversarial and strict-input coverage through the real Arrow sandbox path.

Validation

• pnpm typecheck
• pnpm test
• pnpm test:safety - 34 passed
• pnpm test:gallery - 7 passed
• pnpm build
• pnpm check:public-api
• pnpm smoke:public-packages

Notes: pnpm build reported existing Vite chunk-size warnings, and pnpm smoke:public-packages completed after transient npm registry retry warnings.