Agent: sharing tools that ask first, and a hard delete for a misplaced plop

list_shares, share_garden, remove_share and public_link (get / enable /
rotate / disable) wrap the sharing service. They change who can see a garden
beyond the screen, so they are gated twice: the prompt tells the model to say
exactly what it would do and ask, and the tools refuse without confirmed=true,
which their descriptions allow only after a yes in the conversation. The
refusal names the action, so the question the model asks is precise.

share_garden changes the role of an existing share instead of failing on it;
remove_share takes the email list_shares reports; an unknown email explains
that the person has to sign in once first. public_link returns the address
(PANSY_BASE_URL + /g/<token>, via the new Service.PublicShareURL), never a
bare token.

delete_planting is the hard delete for a plop that was never really planted,
as opposed to remove_planting's "it came out"; it is recorded, so undoable.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/service/public.go

@@ -87,6 +87,18 @@ func (s *Service) EnablePublicShareLink(ctx context.Context, actorID, gardenID i
 	return linkState(token), nil
 }
 
+// PublicShareURL is the address a public link opens at: absolute when the
+// instance knows its base URL (PANSY_BASE_URL), else the site-relative path the
+// editor uses, which a person can complete with the host they are looking at.
+// Exists so the assistant can hand the gardener a link rather than a token.
+func (s *Service) PublicShareURL(token string) string {
+	path := "/g/" + token
+	if s.cfg != nil && s.cfg.BaseURL != "" {
+		return s.cfg.BaseURL + path
+	}
+	return path
+}
+
 // DisablePublicShareLink turns the public link off (clears the token). Owner
 // only; idempotent (disabling an already-disabled link is a no-op success).
 func (s *Service) DisablePublicShareLink(ctx context.Context, actorID, gardenID int64) error {