Keep computer goals executable through scoped recovery and cleanup

[ChesterHsu]

AI Space could lose execution authority during goal correction, reuse another caller's browser, or mistake a redirected observation for an executed action. This preserves the nine runtime commits while consolidating caller-owned browser cleanup, trusted same-goal continuation and retained middleware state, unresolved-parameter refusal, canonical argument recovery, private audit metadata, Traditional Chinese action admission and workspace-scoped file permissions. No blanket privilege increase is introduced.

The scope/validation helpers are extracted without changing public Agent methods or the Core dispatch facade. Existing line budgets and monkeypatch contracts remain enforced. The SDK remains unreleased 0.20.1; its exact Core source dependency is reviewed separately in flytohub/flyto-core#88. No package, tag or deployment is published here.

Validation at 6759bf8:

• Python 3.11 and 3.12 remote CI each passed 4,374 tests, with 15 skips, plus 109 MCP smoke tests, strict verification and distribution builds. All security, CodeQL, documentation and SBOM checks passed.
• Local extraction/adapter regressions passed 151 tests; committed task validation passed Ruff and 39 privacy tests; strict verification passed 18/18. Build and current Twine package checks passed.
• The exact SDK archive was installed with its SHA256 verified. Cloud exercised 153 real installed adapter/Blueprint contracts. A fresh bare install imported its provider without Core or Playwright.

Local verification is recorded separately: an initial full run had 4,371 passes, 17 skips and one missing Core API extra; that source semantic contract passed after installing the declared dev extras. One local rerun hit the tight connector-readiness timing fixture; both complete remote matrices include and pass that case, and no deadline was relaxed.

Live authenticated goal acceptance belongs to Flyto2 Cloud and is not replaced by these deterministic checks. Normal merge still requires the repository's independent approval.