Delegation tests build their inputs by hand instead of through the production delegation refresh

Context

Two review findings landed on #6304 (ddeb0d65c) about eight minutes after it merged, so they never surfaced on the open PR. Both are about how the delegation tests build their inputs, not about the shipped behaviour, which is why they are filed rather than hot-fixed.

1. The unit test hand-builds the delegate instead of using the production path

crates/openhuman-core/src/tools/toolpacks/toolpacks_tests_scoping_and_visibility_tests.rs constructs its ArchetypeDelegationTool directly:

delegate("setup_skills", "skill_setup")

That proves the rule (closed_by_direct_handoff closes a pack whose owner is reachable through an unpacked hand-off), but it would keep passing if refresh_delegation_tools stopped synthesising setup_skills altogether — the exact coupling that made the original #6302 bug invisible.

Partial mitigation already in place: orchestrator_hands_skill_requests_to_the_skill_specialists_directly in tests/agent_harness_e2e.rs boots a real stack and asserts the belt advertises the hand-off, so the production synthesis path is covered somewhere. The gap is that the unit test's own premise is unpinned.

Ask: build the tool set through the production delegation-refresh path, or assert the hand-off name against the registry rather than a literal.

2. The e2e assertion checks a name, not the synthesized hand-off

tests/agent_harness_e2e.rs asserts that a tool with the expected name is advertised. A same-named tool that is not the synthesised delegate would satisfy it.

Weaker than it first reads: the same test also asserts that a later model request advertises specialist-only tools, which is what actually proves the hand-off reached the specialist — an impostor would not produce that. Still worth tightening the first assertion to check the advertised tool is the delegate (e.g. its description is the target's when_to_use).

Provenance

Raised by the tinysweeper/critique and tinysweeper/security lanes on ddeb0d65c. Both ran degraded (code retrieval unavailable: openrouter embeddings 403, "$10.00 daily budget exceeded"; 3 memory calls failed on cortex 502), so they reviewed the diff alone. These two findings hold up on their merits; a third from the same run, claiming ToolPolicySession::deny does not exist and main will not compile, is false — types.rs:175 defines it on a3a965a63 and ops.rs calls it correctly.