feat: add tool scoping and orchestration markers to agent tool registry

Introduce `mark_orchestration_tools`, `set_tool_scope`, and `reset_tool_scope` in `agents/agent.py` to allow runtime filtering of tool payloads by scope and orchestration flag. Refactor `get_tool_payloads` to respect the active scope and exclude orchestration-only tools. Update `agents/core/__init__.py` with `worker_tool_names` helper that returns read/reasoning tools plus conditional write/verify tools per mode, replacing the old `payloads_for` exclusion logic. Modify `agents/maestro.py` to call `mark_orchestration_tools` and wire per-agent result recording via `on_result` callback in `run_fleet`. Extend `agents/orchestrator.py` `run_fleet` signature to accept an optional `on_result` callable and invoke it after each agent run. Revise `agents/style.py` em-dash rule to distinguish prose from data occurrences, and add repository layout guidance to `agents/base.py` MAINT_HEADER.

devplacepy/services/bot/state.py

@@ -2,7 +2,6 @@
 
 import json
 import logging
-import os
 from dataclasses import dataclass, field, asdict
 from pathlib import Path
 
@@ -55,7 +54,7 @@ class BotState:
         path.parent.mkdir(parents=True, exist_ok=True)
         tmp = path.with_suffix(path.suffix + ".tmp")
         tmp.write_text(json.dumps(asdict(self), indent=2, default=str))
-        os.replace(str(tmp), str(path))
+        tmp.replace(path)
 
     @classmethod
     def load(cls, path: Path) -> "BotState":

devplacepy/services/devii/actions/catalog.py

@@ -766,11 +766,12 @@ ACTIONS: tuple[Action, ...] = (
     Action(
         name="list_media",
         method="GET",
-        path="/profile/{username}?tab=media",
+        path="/profile/{username}",
         summary="List a user's uploaded media, newest first",
         requires_auth=False,
         params=(
             path("username", "Username whose media to list."),
+            query("tab", "Profile tab (defaults to media for this action)."),
             query("page", "Page number, 24 per page."),
         ),
     ),

devplacepy/services/devii/actions/dispatcher.py

@@ -45,6 +45,13 @@ CONFIRM_REQUIRED = {
     "delete_comment",
     "delete_gist",
     "delete_attachment",
+    "admin_media_purge",
+    "admin_delete_news",
+    "admin_reset_all_ai_quota",
+    "admin_reset_guest_ai_quota",
+    "admin_reset_user_ai_quota",
+    "container_instance_action",
+    "container_exec",
 }
 
 DESTRUCTIVE_COMMAND = re.compile(

devplacepy/services/jobs/zip_service.py

@@ -3,7 +3,6 @@
 import asyncio
 import json
 import logging
-import os
 import shutil
 import sys
 from pathlib import Path
@@ -52,7 +51,7 @@ class ZipService(JobService):
             stats = await self._run_worker(staging, tmp_zip)
             final_name = self._final_name(job.get("preferred_name", ""), stats["crc32"])
             final_path = tmp_dir / final_name
-            os.replace(tmp_zip, final_path)
+            tmp_zip.replace(final_path)
         except Exception:
             audit.record_system(
                 "job.zip.failed",