feat: advance local-first workspace checklist

- add admin access-policy UI and local access control surfaces

- add local markdown conflict resolution UI and smoke coverage

- add ACP local agent changed-files audit scaffold and read-only write guard

- document current P0-P2 checklist progress and verification evidence

rust/crates/mnote-web/src/hermes_tools/manifest.rs

@@ -173,7 +173,7 @@ fn doc_plan_update_tool() -> Value {
 fn block_replace_tool() -> Value {
     write_tool(
         "mnote.block.replace",
-        "替换指定块内容；真实写入走 Rust page.body.save 链路",
+        "兼容块写工具：替换指定块内容；本地 Markdown 普通编辑优先使用 agent 原生 patch/diff，必要时再走 Rust page.body.write 兼容链路",
         ["block.write", "page.write"],
         json!({
             "blockId": { "type": "string" },
@@ -394,7 +394,7 @@ fn page_get_tool() -> Value {
 fn page_save_tool() -> Value {
     json!({
         "name": "mnote.page.save",
-        "description": "保存当前页面正文；replace 覆盖正文，append/prepend 会先读取当前 Page Aggregate 后合成完整正文再保存",
+        "description": "粗粒度兼容兜底：保存当前页面正文；本地 Markdown 普通编辑优先使用 agent 原生 patch/diff，只有整页覆盖/追加且其它工具无法表达时使用",
         "schemaVersion": TOOL_SCHEMA_VERSION,
         "capabilityScope": ["page.write"],
         "status": "available",
@@ -445,7 +445,7 @@ fn available_tool(
 fn doc_markdown_edit_tool() -> Value {
     let mut tool = write_tool(
         "mnote.doc.markdown_edit",
-        "通过文本级搜索替换编辑 markdown 内容（AI 编辑主路径）。在线 Convex 文档和本地 .md 文件共用，不需要 blockId。",
+        "兼容 / 远端代理 fallback：通过文本级搜索替换编辑 markdown 内容。local-first 本地 workspace 默认优先让 agent 原生 patch/diff 直接编辑授权文件；仅在需要 MNote 兼容工具、远端代理或结构校验时使用。",
         ["block.write", "page.write"],
         json!({
             "operations": {
@@ -489,6 +489,8 @@ fn tool_annotations(
         "readonly": readonly,
         "destructive": destructive,
         "idempotent": idempotent,
+        "readOnly": readonly,
+        "requiresWritePermission": !readonly,
         "requiresApproval": requires_approval,
         "approvalMode": if requires_approval { "review" } else { "yolo" },
         "runtimeOwner": "mnote-web",