feat(agents): add secure fetch native tool

[konglyyy]

Summary

• add the configurable http.fetch.get workspace-native Agent tool
• persist and snapshot normalized URL patterns for Workflow runs
• enforce public HTTPS GET with DNS pinning, SSRF protections, bounded responses, redacted audit fields, and metrics
• align shared native-tool contracts for prompt resources and PDF target-chat scope

Validation

• npm run validate with an isolated PostgreSQL 16 database: 852 tests passed
• type, style, migrations, authorization, membership, run-event, contract, OpenAPI, harness, and build checks passed
• workspace platform-contract check passed

Related PRs and merge order

1. control-plane (this PR) — feat(agents): add secure fetch native tool #17
2. execution-engine — feat(tools): route and redact fetch tool results execution-engine#6
3. management-console — feat(agents): configure fetch native tool management-console#19
4. docs-website — docs(tools): document fetch native tool docs-website#12

Documentation

Updates contract documentation and includes a completed execution plan. User-facing documentation is delivered in the related docs PR.

Residual risk

Live public HTTPS exchange behavior is covered with deterministic policy, DNS, stream, and executor tests rather than a network-dependent test. Production behavior remains subject to the deployment environment DNS resolver and outbound HTTPS policy.