Workspace Toolchain

Activate when a task needs a binary, runtime dependency, PATH surface, tool
pin, local environment, or a decision about where that tool belongs. General
code changes without a tool-ownership question do not activate it.

Resolve the tool layer and its one canonical owner before any effect. Host
tools, project fleet tools, project-specific tools, and development
dependencies have different owners and generators; a host decision never
becomes a project pin by proximity or convenience. Follow the
ownership procedure (skill file) for the exact routing and
runtime proof.

Never write a generated tool surface by hand or add an undeclared PATH entry,
alias, checkout dependency, keyring, retry, fallback, or duplicate installer.
The first missing owner, conflicting owner, invalid pin, failed generator, or
failed runtime check stops the workflow unchanged.