feat(security): grow Yerin's toolset (pending_review, resource_exposure, token_audit)

Three more read-only tools on securityRegistry:
- pending_review: agent-proposed changes awaiting approval (injection surface)
- resource_exposure: host/url/status attack-surface inventory (resources.listExposure,
  scalar cols only — no monitoring/metadata/credentials)
- token_audit: token label/last_used/revoked, never the hash

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/ai/security_tools.test.js

@@ -4,6 +4,9 @@ import { resetDb } from '../helpers/db.js';
 import { migrateUp } from '../../lib/db/migrate.js';
 import { securityRegistry } from '../../lib/ai/agent/tools/security/index.js';
 import * as agentsRepo from '../../lib/db/repos/agents.js';
+import * as resourcesRepo from '../../lib/db/repos/resources.js';
+import * as pendingRepo from '../../lib/db/repos/pending_changes.js';
+import * as spacesRepo from '../../lib/db/repos/spaces.js';
 import { recordAudit } from '../../lib/db/repos/audit.js';
 
 // Yerin's security toolset: read-only observability over the audit trail and
@@ -26,6 +29,9 @@ describe('securityRegistry', () => {
     const names = securityRegistry.listTools().map(t => t.name).sort();
     expect(names).toContain('audit_log');
     expect(names).toContain('agent_inventory');
+    expect(names).toContain('pending_review');
+    expect(names).toContain('resource_exposure');
+    expect(names).toContain('token_audit');
     for (const t of securityRegistry.listTools()) {
       expect(t.name).toBeTruthy();
       expect(t.description).toBeTruthy();
@@ -59,3 +65,51 @@ describe('agent_inventory tool', () => {
     expect(blob).not.toContain('password');
   });
 });
+
+describe('pending_review tool', () => {
+  it('lists pending (unapproved) agent-proposed changes', async () => {
+    await pendingRepo.create({
+      agent_id: watchedAgent.id, entity_type: 'task', entity_id: null,
+      action: 'create', payload: { title: 'proposed' }, reason: 'test'
+    });
+    const tool = securityRegistry.getTool('pending_review');
+    const { pending } = await tool.handler({}, {});
+    expect(Array.isArray(pending)).toBe(true);
+    expect(pending.some(p => p.agent_id === watchedAgent.id && p.action === 'create')).toBe(true);
+  });
+});
+
+describe('resource_exposure tool', () => {
+  it('lists resources (host/url/status) without the monitoring/metadata blobs', async () => {
+    const space = await spacesRepo.create({ slug: `sec-sp-${Date.now()}`, name: 'SP' }, owner);
+    await resourcesRepo.create({
+      space_id: space.id, slug: 'exposed', name: 'Exposed', runtime_type: 'lxc',
+      host: '192.168.1.99', url: 'http://192.168.1.99:8080',
+      monitoring: { secret: 'x' }, metadata: { vault_path: 'env:DB_PASS' }
+    }, owner);
+    const tool = securityRegistry.getTool('resource_exposure');
+    const { resources } = await tool.handler({}, {});
+    const found = resources.find(r => r.slug === 'exposed');
+    expect(found).toBeTruthy();
+    expect(found.host).toBe('192.168.1.99');
+    expect(found.url).toBe('http://192.168.1.99:8080');
+    const blob = JSON.stringify(resources).toLowerCase();
+    expect(blob).not.toContain('vault_path');
+    expect(blob).not.toContain('monitoring');
+  });
+});
+
+describe('token_audit tool', () => {
+  it('lists token metadata (label/last_used/revoked) and never the hash', async () => {
+    const { id: tokenId } = await agentsRepo.createToken(watchedAgent.id, 'ci-token');
+    const tool = securityRegistry.getTool('token_audit');
+    const { tokens } = await tool.handler({}, {});
+    const found = tokens.find(t => t.id === tokenId);
+    expect(found).toBeTruthy();
+    expect(found.label).toBe('ci-token');
+    expect(found).toHaveProperty('revoked_at');
+    const blob = JSON.stringify(tokens).toLowerCase();
+    expect(blob).not.toContain('token_hash');
+    expect(blob).not.toContain('$2b$'); // no bcrypt hash material
+  });
+});