Skill `allowedTools` is advisory: not enforced at runtime, and not documented as such

Version: @flue/runtime 2.0.4 (source checked). Cloudflare target.

Summary

A skill can declare allowedTools, and nothing enforces it. The value is carried in the skill frontmatter type and surfaced to the model, but the runtime never restricts which tools the model may call while that skill is active.

Why it matters

allowedTools reads like a capability restriction. We designed around it initially, assuming a skill marked as code-only could not reach other tools, and only found out by testing that the model can call anything the render declares. Our real guard is our own approval gate, so nothing was exposed — but a reader of the field name would reasonably conclude the opposite, and a host that trusts it has a hole it cannot see.

Proposal

Either enforce it (filter the active tool set while the skill is open), or document it plainly as a hint to the model, in the field's own doc comment as well as the skills guide. We would prefer enforcement, but the documentation fix is the part that prevents a wrong assumption.