Adds explicit plain-text clipboard tools on the channel’s execution host. Reads return one complete, generation-checked result of at most 24 KB and distinguish absent text from an empty string. Persistent writes accept up to 8,192 UTF-16 units, enter the existing pending-paste reservation gate, and use the existing unsafe-replay pipeline. They do not paste, save prior contents, or restore the clipboard.

Part of #72 and #8; extracts the bounded text slice from #75. Image/file access and temporary paste remain separate. Expected read refusals retain `invalidRequest` and their useful reason. The build verifies the complete ordered native patch stack in a private index and refuses unknown source drift.

Validation:

- Types/lint, Swift parsing, independent source review, signed build and strict signatures passed. Final head `c64042b` includes main `bc7f20e`; its clipboard patch/client are byte-identical to the live-tested `4a2f29b`. The final merge adds the independently validated normal-quit path. - Actual GUI reads passed Unicode/CRLF with HTML/RTF alternate representations, empty versus absent text, and generation checks. Multiple items, unreadable advertised text and oversized complete/JSON-encoded results were refused. Empty and 8,192-unit Unicode writes round-tripped; 8,193 units refused without mutation. The initial multiline write/read passed at `51829aa`, valid reads at `e690a17`, and the corrected refusal/boundary cases at `4a2f29b`; passed unchanged cases were not replayed after merges. - A real `gpt-6-sol` channel performed one public write and read. Reopening the completed durable store preserved exact results with no added usage, tool calls, or clipboard generation; this is completed-store replay proof, not an in-flight crash claim. - One actual delayed WebKit paste returned uncertain consumption with a retained reservation. A read returned its known public text; a competing write refused before mutation. After one trusted paste/input and exact receiver termination, normal product write admission succeeded. - The original complete clipboard stayed only in a private GUI-memory vault and was restored only at the exact owned generation. Every native call drained; all owned fixtures/apps/hosts closed, and the temporary model channel/project was removed. No private clipboard payload was logged or stored in channel history. Failed fixture setup attempts stopped before input and remain recorded separately.

### Built in Ace

Nate explicitly allowed direct tools for this #8 pass. Codex shell/file tools and review agents implemented, built and reviewed the change; real Ace host/channel/model/native tools performed the validation, and GitHub CLI handled this PR. The capability gap is #72; external harness support remains #9. No installed app, OS permission, or existing channel data was changed. Temporary validation used public nonce payloads and the existing clipboard gate.