add a "Trusted only" mode

[simonpcouch]

Closes #363.

In commons(mode = "trusted only"), the agent loses the SQL and R/Python tool, describe_table() no longer shows sample rows, and there are no badges at the end of responses. The model either finds a trusted calculation and invokes it or notes to the user that it can't find one.

trusted-only.mov

(FYI for Josh once I request review: I've opted not to implement on the Python side. If you're game to give this a go, you're welcome to either push straight to this branch or stack on top!)

[github-actions]

Preview deployed to Connect (dogfood.team.pct.posit.it): https://dogfood.team.pct.posit.it/connect/#/apps/d7a36cae-8f27-448b-a478-61b81fbe3942/draft/378030

Deployed from commit 4b1b516.

[github-actions]

Preview root: https://posit-dev.github.io/commons/pr-395/

Python site preview: https://posit-dev.github.io/commons/pr-395/py/

Built from the latest commit on this branch. The R links in it point at the published R site, which no pull request rebuilds.

[github-actions]

Preview deployed to Connect (connect.staging.pct.posit.it): https://connect.staging.pct.posit.it/connect/#/apps/ad662e1b-5048-4acc-9ad7-f9478c92274e/draft/3418

Deployed from commit 4b1b516.

[simonpcouch]

Review from GPT-6.1 Sol

Code review (agent-written)

Two findings at 321c6e9:

1. [P2] Preserve access to complete trusted results. Making private$handles <- new_handle_store() conditional removes access to results beyond the 50-row cap in df_to_markdown() and df_to_html(). A no-argument measure returning 51 rows hides row 51 from both the model and the UI. With no run_r or pagination, the agent cannot even compare all the returned values, which the new prompt explicitly allows. Provide a trusted way to read the remaining rows. Relevant change.

2. [P2] Render the full schema when omitting samples. For an undocumented table, df_to_markdown(d$schema) caps the column listing at 50 rows. The sample summary previously supplied every column name through max_cols = ncol(d$sample); removing it now hides columns after the fiftieth. A 51-column table reproduces this. Render all schema rows so the agent can still discover the names accepted by trusted calculations. Relevant change.

[jat255]

LGTM! I created #407 to track the Python side.

[github-actions]

Cleaned up 2 preview bundle(s) on https://dogfood.team.pct.posit.it: 374980, 378030

[github-actions]

Cleaned up 2 preview bundle(s) on https://connect.staging.pct.posit.it: 3195, 3418