fix(agent-runtime): forbid workspace mutation via Bash in Plan/Goal prompts

[ZxlDragonDoctor]

Problem

Plan mode still mutates workspace files after a few turns (#297). Write/Edit are host-denied in contract modes, but Bash stays on the Plan/Goal allowlist. PLAN_MODE_SYSTEM_PROMPT / GOAL_MODE_SYSTEM_PROMPT previously said Bash "may mutate files" under the active permission policy, so the model could implement changes while the session remained in Plan.

Solution

Tighten both contract-mode system prompts only (no permission-policy change):

• Bash is inspection/planning only in Plan and Goal.
• Explicitly forbid create/overwrite/delete via Bash.
• If implementation is requested: ask the user to switch to Agent mode (Plan) or submit the goal for approval (Goal).

Host-core plan_mode_allows still permits Bash; Write/Edit remain hard-denied. This change is the model-facing contract so the agent does not treat Bash as an implementation channel.

Testing

• Command: pnpm --filter @pi-desktop/agent-runtime exec vitest run src/mode-prompts.test.ts
• Result: 3 passed
• Cases: Plan prompt pins the no-mutation + ask-to-switch language; Goal prompt pins the no-mutation language; Agent composition stays free of Plan deny text.

Issue alignment

• Addresses [Bug] Plan Mode writes files #297 expected behavior: agent should know it is in Plan mode and ask the user to switch before implementing.
• No maintainer design note on the issue (0 comments before my claim on 2026-09-14).

Agent dimension

human-in-the-loop

Core value

Plan/Goal no longer tell the model Bash may mutate the workspace, closing the multi-turn implement-while-planning path.