Scope managed posture to declared owned sources

[chubes4]

Closes #318.

--posture managed (shipped in v1.11.0) granted edit on all of wp-content/plugins/ and wp-content/themes/. On h44lacrosse.com that put WooCommerce, the Stripe gateway, Data Machine, and the agent's own data-machine-code runtime inside an autonomous agent's write surface — on a site taking real card payments.

Three paths there are actually the site's own (h44-core, h44-forms, h44-lacrosse-theme), and those three are exactly what its harvest.yml captures.

Why this was worse than "too broad"

The managed guidance tells the agent its edits are captured as restore points. Outside the harvested set that is false — an edit to WooCommerce is never recorded and is erased by the next update. The agent was told a safety property that did not hold for most of what it was granted.

Root cause is the prose-vs-permission split #314 existed to eliminate, reintroduced one level down: the guidance enumerated ("this site's theme and plugins"), the policy generalised (two directories).

The invariant

The editable set must equal the set the operator's capture records.

A path the agent can edit but nothing records is a path where it silently loses work, invisibly, until an update overwrites it. There is no reliable way to infer which plugins a site "owns", and guessing wrong on production is not an acceptable default — so it is declared:

./setup.sh --posture managed \
  --managed-source wp-content/themes/acme \
  --managed-source wp-content/plugins/acme-core

Recorded as wp_coding_agents_managed_sources so upgrades converge. Managed now denies all three roots exactly as engineering does, then emits one allow per declared path.

Fails closed. Managed with nothing declared grants no editable source, and the guidance says so explicitly rather than implying a directory is editable. Malformed declarations (outside wp-content, or a file inside a component) are rejected with a reason.

Rule order is now load-bearing

Verified against opencode 1.18.4 source, not the docs — the two disagree, which is the subject of several open upstream issues (#7029, #13872, #24335, #24999, #36765):

// packages/opencode/src/permission/index.ts
.findLast((rule) => Wildcard.match(permission, rule.permission) && Wildcard.match(pattern, rule.pattern))
// fromConfig(): iterates Object.entries(value) — JSON key order

findLast over a ruleset built in config key order, with no specificity sorting in evaluate (Wildcard.all's length sort is used elsewhere). So a narrower allow written after a broad deny wins. Both the generator and the reconciler preserve deny-before-allow, and the tests assert the ordering rather than comparing sorted keys — sort_keys=True would have destroyed the property under test.

Runtime support narrowed, deliberately

Managed is now opencode-only. Claude Code treats deny as absolute so an allow cannot carve an exception out of it; Codex has no documented precedence for overlapping filesystem entries. Both now refuse managed posture with a clear error rather than emit a permission set whose behavior on a production site I could not verify. Their engineering paths are untouched.

Guidance rewritten

Enumerates the declared paths by name, states the list is exhaustive, and marks the remainder of wp-content read-only — naming commerce/payment code and the agent's own runtime as things it must not touch, with the reason (an update erases the change anyway). The heading no longer labels the whole category editable.

Verification

• Engineering output unchanged — generated opencode.json diffed byte-for-byte against generation from v1.11.0: identical.
• tests/posture.sh extended: ordering (deny index < allow index), fail-closed with nothing declared, normalization rejecting bad paths, the three runtimes' managed support, prose enumerating every declared path, prose never presenting a directory as editable, and fail-closed prose.
• Reconciler covered for insertion order, operator-rule preservation, and dropping a stale allow when a source is undeclared.
• Full tests/*.sh: no new failures (same 7 pre-existing environment failures as main, none in shell.yml). bash -n clean.

Follow-up

Re-applying to h44lacrosse.com is an operator action, not part of this PR. That box currently has the over-broad grant live.