Implements the loud-tool-arg-validation OpenSpec change: LLM-supplied
tool arguments are never silently discarded, coerced, or overridden.

- Unknown-key validation at DispatchingToolExecutor (sync + streaming):
  unrecognized argument keys reject the call before execution with a
  "did you mean" suggestion and the valid argument names. Recognition
  mirrors actual consumption semantics — flexible (case/punctuation)
  for declared parameters, exact-only for meta keys. Fuzzy matching
  generates suggestion text only, never acceptance. MCP tools exempt
  (server-side schema validation is authoritative).
- Strict value binding: new GetIntStrict/GetDoubleStrict/GetBoolStrict
  helpers distinguish absent from present-but-invalid; the tool source
  generator emits them so invalid values reject instead of coercing to
  0/0.0/false. Non-integral numerics no longer silently truncate, and
  non-integral/overflow JSON numbers no longer throw uncaught.
- Meta-value validation: malformed _timeout_seconds/_background values
  reject pre-dispatch (pipeline-side; persisted ToolCallMeta unchanged).
- Override notices: timeout ceiling clamps and below-floor requests now
  surface in the tool result (appended post-bounding so they cannot be
  spilled away), steering to _background:true for longer work.
- Provider boundary: malformed tool-call arguments JSON travels as a
  sentinel and is rejected per call id instead of dispatching the tool
  with null arguments; deterministic on persistence re-drive.
- web_fetch: Format validated against {raw, text} (no silent raw
  fallback); 5 MB response-cap truncation is surfaced in the summary.
- list_webhooks: the schema-advertised Filter parameter is honored
  (active/all) instead of being a silent no-op.
- netclaw-operations skill v2.12.0: timeout-clamp and background-job
  delegation guidance, strict argument naming rules.
- New eval case tool_timeout_arg_recovery (passed 3/3 against
  Qwen3.6-35B on self-hosted vLLM); full suite 4,998 tests green.

Origin: production session D0AC6CKBK5K_1781115410_840529, where
"TimeoutSeconds":"1200" was silently dropped and the shell timeout
fell back to a 90s default, killing a delegation call mid-flight.

The test asserted a valid ShellTool call passed validation but never
touched an McpToolAdapter, leaving the "MCP tool exempt from native key
validation" spec scenario without real coverage. It now registers an
McpToolAdapter, dispatches a call with an unknown argument key, and
asserts the native "Unrecognized argument" rejection does not fire —
the unknown-key gate runs before authorization, so any other outcome
proves the exemption.

Sync delta specs to main specs:
- New capability spec tool-arg-validation (unknown-key rejection with
  suggestion-only near-miss matching, present-but-invalid value
  rejection, malformed args-JSON handling, override notices)
- tool-call-metadata: per-call timeout hint now surfaces clamp/floor
  overrides in the tool result; new malformed-meta-value rejection
  requirement
- netclaw-tools: web_fetch format validation + response-cap truncation
  notice; list_webhooks filter honored

Archive change to openspec/changes/archive/2026-06-11-loud-tool-arg-validation
(26/26 tasks, verification clean, eval suite 7/7).

Correctness:
- Accept integral JSON numbers written with a decimal point (300.0, 12.0)
  as integers; JsonElement.TryGetInt32 rejects that text, so coercion now
  falls back to an integral-double check (12.5 still rejected). Models
  commonly emit whole numbers as N.0, which previously hit a spurious
  "not a valid integer" rejection loop.
- Parse string-typed numeric arguments with InvariantCulture. The daemon
  runs with InvariantGlobalization=false, so a comma-decimal host locale
  previously misparsed or falsely rejected values like "1.5".
- Consolidate all pre-dispatch validation (provider args-parse sentinel,
  present-but-invalid meta values, unrecognized keys) into
  IToolExecutor.ValidateToolCall. The sub-agent loop calls the executor
  directly and previously skipped meta-value validation and the sentinel
  check — the silent-fallback gap this feature exists to close.
- Audit unknown-argument rejections as Allowed=false: the pipeline now
  preflights via ValidateToolCall instead of running the executor and
  mislogging the rejected call as executed.
- Accept the text<->Message parameter alias bidirectionally so a
  send_channel_message call using "Message" (which binding consumes) is
  no longer rejected. Alias defined once in ToolArgumentHelper.
- Clamp background-job timeouts to MaxToolTimeoutSeconds so _background
  cannot bypass the ceiling (was an unbounded kill timer).
- Bound the args-parse sentinel value (200 chars) so a forged/oversized
  value cannot flood the tool result.

Cleanup:
- One shared TryCoerceInt/Double/Bool + RenderValue across the strict
  binders, ToolCallMeta.ExtractFrom, and ValidateMetaValues (was three
  hand-mirrored ladders that had to stay in lockstep by hand).
- Delete the now-unused GetNullableInt/Double/Bool helpers.
- web_fetch streams into a pooled growing buffer: no eager 5 MB
  allocation per fetch, no 5 MB slice-copy on truncation.

Full suite 5,004 tests green; slopwatch clean; headers verified.

…ad-write-build-loop

# Conflicts:
#	feeds/skills/.system/files/netclaw-operations/SKILL.md

NuGetAudit flags MessagePack 2.5.192 (GHSA-hv8m-jj95-wg3x — LZ4 decompression
DoS), pulled in transitively only by the Aspire demo samples:
  Aspire.Hosting.AppHost → StreamJsonRpc 2.22.23 → MessagePack 2.5.192
Netclaw uses MessagePack in no production code, and the affected LZ4 path is
not exercised by Aspire's local tooling RPC — but the advisory DB update turned
it into a warning-as-error that fails pr_validation's solution build (dev is
affected identically). Pin to the patched v2 (2.5.301) via central package
management + a direct reference in the two sample projects to promote the
transitive. Same minor branch, no API risk for StreamJsonRpc.