[Debt] Unify workspace/memory tools with core policy enforcement

[FreeTurtle7]

Currently, workspace and memory tools (like write_file, edit_file, append_memory) overlap in functionality and have inconsistent security/approval requirements.

• write_file and edit_file to soul.md and config.md require founder approval.
• Other workspace files (notes, strategy, daily memory) do not.
• This logic is currently scattered across runner.ts and workspace/index.ts.

Technical Debt:

1. Unify all file-modifying tools into a single core library that enforces policy (allowlists and approval rules).
2. Create a specific evolve_soul tool that formalizes the reflections/ proposal process rather than just relying on generic edit_file with approval.
3. Consistently apply path sandboxing and PII redaction across all memory/workspace tools.
4. Ensure reload_config is automatically triggered when config.md is updated via any tool.