solution: remaining method-policy open questions (successor to #295)

[antoinetoussaint-byte]

Successor tracker to #295, which is closed by #296. #296 settled the one method-policy question that did not depend on a real caller existing — the two-API split (task #2): solution.Client is now the single canonical dispatch path and WithCeiling is unexported.

The remaining four tasks from #295 stay open because — per #295's own premise — they "only become answerable once a real caller exists," and that caller (the CLI solution command group) lives in the separate codefly binary repo, not in core. They are carried here so closing #295 does not drop them:

• Wire the first host caller. The CLI solution command group (follow-up to New agent kind: codefly:solution — registry entry, proto enum, manifest schema, proto service #287) should drive the lifecycle through solution.Client. This is the linchpin that exercises everything below. (Cross-repo: codefly CLI binary.)
• Validate the ceiling vocabulary. Confirm CeilingInspect/Scaffold/Render/Publish map cleanly to real host operations (e.g. a deploy that packages and renders currently must use CeilingPublish), or recut the tiers. The tiers are internally coherent today (TestOperationCeilingsAdmitExactlyTheirRPCs); the judgment needs the real caller's operations.
• Confirm the Render network assumption. Render is annotated REGISTRY_READ because RenderRequest carries only artifact_reference and the executor pulls the artifact itself. If the host instead resolves the artifact host-side and hands the executor local content, Render should be OFFLINE and CeilingScaffold should re-admit it. Load-bearing and unverified against an implementation (cross-repo host executor).
• Give the ceiling a real provenance. The ceiling is still whatever the caller passes; it becomes genuine enforcement only when derived from an authorized operation/principal/environment at a trusted chokepoint — a design that needs the consumer to shape it.

Context

• Enforcement code: solution/policy.go, installed in agents/manager/loader.go.
• Acceptance bar (from New agent kind: codefly:solution — registry entry, proto enum, manifest schema, proto service #287): an end-to-end tracer bullet reaching an ArgoCD-synced namespace (obin-ai/lodestar#17).