fix: 9.5-code reachable items (parse unification, goal branch, fail-open logs, M7 test, fingerprint)

Parse: agent_tools/tool_approvals column parsing unified into agent_def shared helpers (parse None = undeclared; server keeps None, worker maps to []/{} at _task_from_row, dispatch behaviour unchanged). Goal: _apply_resume_preamble goal branch proven reachable via _goal_convert_queued on a queued auto-resumed task, kept with a test and corrected docs (not dead code). Fail-open: audit write failure and preamble lookup failure now log warnings (best-effort unchanged); partial policy failure and shadow parse drops documented as known gaps. M7: shadow endpoint explicit_capability_failures_truncated test. Fingerprint: RoutingPolicy.content_fingerprint (canonical JSON sha256, version excluded) surfaced only in dry-run output, never in audit rows. M1 wording: legacy gap stated as fixed stock persisting per-task until completion, not converging.

cloud/server.py

@@ -60,6 +60,8 @@ from urllib.parse import parse_qs, quote, urlparse
 from cloud.agent_def import default_agents_dir as _agent_default_dir
 from cloud.agent_def import list_known_skills as _agent_known_skills
 from cloud.agent_def import parse_agent_definition as _parse_agent_definition
+from cloud.agent_def import parse_agent_tool_approvals_column as _parse_tool_approvals_col
+from cloud.agent_def import parse_agent_tools_column as _parse_tools_col
 from cloud.agent_def import resolve_registry_agent as _resolve_agent
 from cloud.attempts import ensure_attempts_table as _ensure_attempts
 from cloud.auth import ROLES as _MEMBER_ROLES
@@ -1798,32 +1800,19 @@ def _row_get(row, name):
 
 
 def _agent_tools_from_row(row):
-    """agent_tools 列的容错解析：JSON 数组，非数组/脏数据为 None。"""
-    raw = _row_get(row, "agent_tools")
-    if raw is None:
-        return None
-    if isinstance(raw, list):
-        return list(raw)
-    try:
-        parsed = json.loads(raw)
-    except (TypeError, ValueError):
-        return None
-    return list(parsed) if isinstance(parsed, list) else None
+    """agent_tools 列的容错解析：唯一实现在
+    agent_def.parse_agent_tools_column（9.5-code 统一）；本
+    函数只取列值并转发，缺列/脏数据为 None（= 未声明），
+    序列化口径与统一前逐字一致。"""
+    return _parse_tools_col(_row_get(row, "agent_tools"))
 
 
 def _agent_tool_approvals_from_row(row):
-    """agent_tool_approvals 列的容错解析：JSON 对象，非对象/脏
+    """agent_tool_approvals 列的容错解析：唯一实现在
+    agent_def.parse_agent_tool_approvals_column；缺列/脏
     数据为 None（NULL = 未声明，与 v3 tools 同款语义）。"""
-    raw = _row_get(row, "agent_tool_approvals")
-    if raw is None:
-        return None
-    if isinstance(raw, dict):
-        return dict(raw)
-    try:
-        parsed = json.loads(raw)
-    except (TypeError, ValueError):
-        return None
-    return dict(parsed) if isinstance(parsed, dict) else None
+    return _parse_tool_approvals_col(
+        _row_get(row, "agent_tool_approvals"))
 
 
 def _task_to_dict(row, attachments=None, total_tokens=None):