feat: add tool scoping and orchestration markers to agent tool registry

Introduce `mark_orchestration_tools`, `set_tool_scope`, and `reset_tool_scope` in `agents/agent.py` to allow runtime filtering of tool payloads by scope and orchestration flag. Refactor `get_tool_payloads` to respect the active scope and exclude orchestration-only tools. Update `agents/core/__init__.py` with `worker_tool_names` helper that returns read/reasoning tools plus conditional write/verify tools per mode, replacing the old `payloads_for` exclusion logic. Modify `agents/maestro.py` to call `mark_orchestration_tools` and wire per-agent result recording via `on_result` callback in `run_fleet`. Extend `agents/orchestrator.py` `run_fleet` signature to accept an optional `on_result` callable and invoke it after each agent run. Revise `agents/style.py` em-dash rule to distinguish prose from data occurrences, and add repository layout guidance to `agents/base.py` MAINT_HEADER.

devplacepy/services/devii/actions/catalog.py

@@ -766,11 +766,12 @@ ACTIONS: tuple[Action, ...] = (
     Action(
         name="list_media",
         method="GET",
-        path="/profile/{username}?tab=media",
+        path="/profile/{username}",
         summary="List a user's uploaded media, newest first",
         requires_auth=False,
         params=(
             path("username", "Username whose media to list."),
+            query("tab", "Profile tab (defaults to media for this action)."),
             query("page", "Page number, 24 per page."),
         ),
     ),

devplacepy/services/devii/actions/dispatcher.py

@@ -45,6 +45,13 @@ CONFIRM_REQUIRED = {
     "delete_comment",
     "delete_gist",
     "delete_attachment",
+    "admin_media_purge",
+    "admin_delete_news",
+    "admin_reset_all_ai_quota",
+    "admin_reset_guest_ai_quota",
+    "admin_reset_user_ai_quota",
+    "container_instance_action",
+    "container_exec",
 }
 
 DESTRUCTIVE_COMMAND = re.compile(