Bump agentseam to 0.2.1, derive shell matcher and repo-root token - #104

What

Bumps the agentseam pin from 0.2.0 to 0.2.1 and wires the two real gaps
this release closes, in the same PR (neither half is green alone against the
new pin):

1. Shell-vocabulary borrow, closed. agentseam 0.2.1 now records a shell
   vocabulary (tools.shell) for codex_cli (("Bash",)) and
   vscode_copilot (("bash", "powershell", "Bash")), where 0.2.0 recorded
   none. in_agent.hooks_map_file used to hardcode claude_code's borrowed
   MATCHER for all three vendors' claude-format plugin hooks; it now reads
   each vendor's own vocabulary via vendors.shell_matcher(vendor).
2. ${CLAUDE_PROJECT_DIR} token, closed. agentseam 0.2.1's vendor-config
   schema now carries repo_root_token, populated for claude_code.
   in_agent.PROJECT_DIR_TOKEN used to be chock's own hardcoded copy; it now
   reads vendors.repo_root_token("claude_code") (new accessor in
   vendors.py, same pattern as the existing config_path/shell_matcher
   accessors — public agentseam API only, no private imports).

Both of tests/test_vendor_wire_facts.py's tripwire tests for these gaps are
retired into derivation checks (the intent — chock and agentseam must not
silently drift apart on these two facts — survives the gap closing): they now
fail if a future agentseam release drops either field again, instead of
failing when it (correctly) adds one. Two hook-runtime tests
(test_copilot_hook_runtime.py, test_copilot_plugin.py) that had asserted
the old borrowed-matcher value as correct are updated to assert each vendor's
own derived matcher instead.

Emitter-stability and runtime goldens are regenerated
(CHOCK_REGEN_GOLDENS=1); this repo's own compiled output is refreshed via
chock sync --repo .. The runtime-golden diffs are larger than a version-stamp
line because agentseam 0.2.1 also refactored contract.py's internals
(extracted helper functions, alphabetized __slots__, a specific exception
type in place of a bare except) — verified as non-behavioral: the full test
suite passes, and the only content diffs beyond that refactor are the two
deliberate fixes above (codex_cli/vscode_copilot matcher, claude_code
repo_root_token).

Update: the first push's CI caught a real regression this session's local
pytest -q didn't exercise: the brand-assets job installs a second,
independent pip-compile lockfile (requirements/brand-assets.txt) that was
still pinned to agentseam==0.2.0, then imports chock's own in_agent.py to
render the social-preview SVG — which now asserts PROJECT_DIR_TOKEN is not None at import time, a field 0.2.0 doesn't have. Fixed by bumping
requirements/brand-assets.in to 0.2.1 too and regenerating
requirements/brand-assets.txt with pip-compile --generate-hashes (Python
3.12); verified locally with pip install --require-hashes and a local run of
docs/assets/gen_brand_assets.py --check before pushing.

No consumer-visible capability claim widens — this only makes two existing
derivations honest about their upstream source.

Definition of done

• chock check → 0 errors, 0 warnings, 0 infos
• chock check --only matrix passes; no behavior change, matrix unchanged
• chock sync --repo . --check clean (compiled artifacts match their manifests)
• chock check --only verify clean (lockfile matches packs and compiled artifacts)
• Registry rescanned; no stale entries
• pytest -q green (1055 passed, 2 skipped) against the real agentseam==0.2.1 install
• pytest acceptance/ -c acceptance/pytest.ini --rootdir=acceptance green (21 passed) —
  packaging/hook-installation surfaces are touched by the matcher fix
• No manifests touched (no new/extended checks)
• ruff check . and ruff format --check . clean

Claims

• No surface is described as enforcing more than it installs — this PR only changes where
  two already-emitted facts are read from, not what's emitted or installed.

🤖 Generated with Claude Code