Agent: sharing tools that ask first, and a hard delete for a misplaced plop

list_shares, share_garden, remove_share and public_link (get / enable /
rotate / disable) wrap the sharing service. They change who can see a garden
beyond the screen, so they are gated twice: the prompt tells the model to say
exactly what it would do and ask, and the tools refuse without confirmed=true,
which their descriptions allow only after a yes in the conversation. The
refusal names the action, so the question the model asks is precise.

share_garden changes the role of an existing share instead of failing on it;
remove_share takes the email list_shares reports; an unknown email explains
that the person has to sign in once first. public_link returns the address
(PANSY_BASE_URL + /g/<token>, via the new Service.PublicShareURL), never a
bare token.

delete_planting is the hard delete for a plop that was never really planted,
as opposed to remove_planting's "it came out"; it is recorded, so undoable.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/agent/runtime.go

@@ -307,6 +307,11 @@ How to work:
   frost dates, soil, a standing preference — add it to the garden's notes with update_garden
   (keeping what is already there), and say you did. You will see those notes in every later
   conversation.
+- Sharing is outward-facing: share_garden, remove_share and turning the public link on, off or
+  over change who can see the garden, beyond this screen. Before any of them, say exactly what
+  you would do — who, which role, or that a link will start or stop working — and ask; do it
+  only when the gardener says yes, and then pass confirmed=true. A message that already says
+  it all ("share this with [email protected] as an editor") still gets the question once.
 - When a tool refuses (for example, the user only has view access to this garden), explain what
   happened in plain words. Do not retry it.