feat: add then_run verification to edit_file and write_file

[MelodyVAR]

Summary

Adds an optional then_run parameter to edit_file and write_file. After a successful mutation (including a no-op), the command runs like run_command without cwd (initial working directory, configured timeout, same output cap) and its output and exit status are appended to the same tool result, with structured data in details.thenRun. This saves a separate run_command round trip for the common edit-then-verify pattern.

• A failing check does not mark the call as an error, since the change is already applied; caller cancellation still propagates with the mutation receipt.
• Empty or whitespace-only values are ignored. Existing tool descriptions are unchanged; only the optional property is added.

Gating

then_run is treated as an embedded run_command call:

• Permissions: the stricter of the mutation and command decisions, including run_command overrides and dangerous-command analysis; confirmations name the command.
• Workflow path ACLs check the command.
• Blocked when run_command is not an active tool.
• SDK acceptEdits no longer auto-approves an edit carrying then_run.

UI / prompt / docs

• Tool result shows a one-line then_run $ <cmd> · exit N status (full output when expanded).
• System prompt hint when edit tools and run_command are both active.
• docs/step-integration.md documents the semantics and gating.

Tests

• step-tool-profile, step-permissions, workflow-runtime, step-system-prompt, step-stdio-host, workflow-extension, suite/step-command-approval: 139 passed
• Full coding-agent suite: 3727 passed; 2 failures unrelated to this change (2791-fswatch-error-crash also fails on main; feedback.test.ts is flaky under full-suite load and passes on its own)
• biome and tsgo --noEmit clean for the changed files