Ship agent CLIs with an outbox, not direct publish

If an agent-invoked CLI performs external publishes itself, runtime safety layers can rightly block it as config-instructed exfiltration. Split it crash-reporter style: the agent command only writes the payload to a local outbox; the tool own deterministic code (spawned by a lifecycle hook) uploads under the consent granted at install. Same product, zero blocked posts, and offline retry for free.