feat: add file.patch tool for multi-hunk structured patches

Implements apply_patch equivalent: a single tool call can make multiple
line-based edits (replacements, insertions, deletions) across one or more
files. Hunks are applied bottom-up to preserve line numbers.

Includes 10 tests covering replacement, multi-hunk, insertion, deletion,
multi-file, overlapping hunks error, OOB error, and edge cases.

src/tools/policy.ts

@@ -29,6 +29,7 @@ const PROFILE_TOOLS: Record<ToolProfile, Set<string>> = {
     'web.search',
     'file.write',
     'file.edit',
+    'file.patch',
     'shell.exec',
     'process.start',
     'process.status',
@@ -49,7 +50,7 @@ const PROFILE_TOOLS: Record<ToolProfile, Set<string>> = {
 
 /** Named groups for use in allow/deny lists (e.g. 'group:fs'). */
 export const TOOL_GROUPS: Record<string, string[]> = {
-  'group:fs': ['file.read', 'file.write', 'file.edit', 'file.list'],
+  'group:fs': ['file.read', 'file.write', 'file.edit', 'file.patch', 'file.list'],
   'group:runtime': ['shell.exec', 'process.start', 'process.output', 'process.status', 'process.kill', 'process.list'],
   'group:web': ['web.fetch', 'web.search', 'browser.navigate', 'browser.screenshot', 'browser.click', 'browser.type', 'browser.content', 'browser.eval'],
   'group:memory': ['memory.read', 'memory.write', 'memory.search'],