feat(provider-tangle): narrow interactions by backend catalog

[drewstone]

Summary Narrow agent-provider-tangle interaction capabilities from the canonical Sandbox backend catalog. The provider resolves the configured defaultBackend, intersects declared interaction kinds with the backend catalog, and removes the interaction claim when lookup is unavailable, throws, or finds no backend. It preserves the existing provider API and leaves Braid unchanged. It works with published Sandbox 0.30.1 through listBackends(); getBackend() is optional for newer SDKs. ## Proof agent-interface build passed; provider check-types passed; provider build passed; provider tests passed 145/145; contract tests cover Pi permission-only narrowing, lookup failure, and absent backend fail-closed behavior; diff check and pre-push hooks passed. The Sandbox SDK catalog remains the only backend capability authority.

[tangletools]

✅ Auto-approved drewstone PR — 69db3bf2

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-20T07:17:31Z}