feat(toolbox): the first four doors out of the toolbox, without a chat client on the way

B-gate row 1's premise, made callable. Every path through the framework CLI constructs a chat
client, so an outside caller -- a human at a terminal, or an agent that is NOT po -- could not
reach a single run-path step without paying for a model. These four steps need no model at all.

One CLI, four subcommands, one core call each:

  navigate-bundle  --bundle-dir                         -> okf.navigate_bundle
  cost-baseline    --bundle-dir --project-id            -> okf.derive_cost_baseline
  retrieve-chunks  --query --docs-dir [--top-k]         -> datasource.retrieve_chunks
  prepass-admit    --payload --bundle-dir [--dimension] -> prepass.admit_payload

Each handler is a thin adapter: strings in, the SAME function the run path calls, JSON on stdout,
and an exit code that says what happened (0 ran, 2 malformed call, 3 the step refused, named).
A handler that computed anything of its own would be a second implementation of a run-path step,
and the outside caller would stop getting what the debate gets.

Dispatch is an explicit branch per command, not argparse's `set_defaults(handler=...)`: the table
hides the one thing a reader wants to see, and B-gate row 1 asks the same question of the source
(it walks the call graph from `main` down to the step's symbol), where a callable in a Namespace
is a hop neither can follow.

Probes (`tests/test_toolbox_doors.py`, 10 arms): each starts the door as a SUBPROCESS with the
subcommand in argv and asserts on what it wrote -- never by importing the core function, which is
the whole difference the gate exists to measure. The yardstick is outside the door in every arm:
the filesystem (navigate-bundle, including the one deliberate outside-bundle link), a table
transcribed from the priced fixture (cost-baseline), the in-process seam it must equal byte for
byte (retrieve-chunks), and the producer's own checked-in payload (prepass-admit). Every refusal
arm has an rc-0 control beside it.

`portfolio-optimiser-toolbox` is the THIRD console script, and the pin test now says why: it is
the door the other two cannot be used for. README and CLAUDE.md updated with the command and the
reason it exists; every documented invocation was run.

Row 1: 1 -> 5 of 17 (four subcommands + `gate`, which the class fix in e47be68 stopped rejecting
on a name technicality). No other row moved; exit 1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/portfolio_optimiser/evals/b_gate.json

@@ -130,11 +130,14 @@
         "scope": "run_project"
       },
       "entry": {
-        "kind": "console-script",
-        "module": "run.py",
-        "scope": "main"
+        "kind": "subcommand",
+        "module": "toolbox.py",
+        "scope": "main",
+        "command": "navigate-bundle"
       },
-      "probe": []
+      "probe": [
+        "tests/test_toolbox_doors.py::test_navigate_bundle_from_outside_reports_every_file_the_base_holds"
+      ]
     },
     {
       "id": "kostnadsgrunnlag",
@@ -146,11 +149,14 @@
         "scope": "run_project"
       },
       "entry": {
-        "kind": "console-script",
-        "module": "run.py",
-        "scope": "main"
+        "kind": "subcommand",
+        "module": "toolbox.py",
+        "scope": "main",
+        "command": "cost-baseline"
       },
-      "probe": []
+      "probe": [
+        "tests/test_toolbox_doors.py::test_cost_baseline_from_outside_derives_exactly_what_the_priced_table_says"
+      ]
     },
     {
       "id": "kontekst",
@@ -162,11 +168,14 @@
         "scope": "run_project"
       },
       "entry": {
-        "kind": "console-script",
-        "module": "run.py",
-        "scope": "main"
+        "kind": "subcommand",
+        "module": "toolbox.py",
+        "scope": "main",
+        "command": "retrieve-chunks"
       },
-      "probe": []
+      "probe": [
+        "tests/test_toolbox_doors.py::test_retrieve_chunks_from_outside_matches_the_in_process_seam_exactly"
+      ]
     },
     {
       "id": "prepass",
@@ -178,11 +187,14 @@
         "scope": "run_project"
       },
       "entry": {
-        "kind": "console-script",
-        "module": "run.py",
-        "scope": "main"
+        "kind": "subcommand",
+        "module": "toolbox.py",
+        "scope": "main",
+        "command": "prepass-admit"
       },
-      "probe": []
+      "probe": [
+        "tests/test_toolbox_doors.py::test_prepass_admit_from_outside_admits_the_producers_own_payload"
+      ]
     },
     {
       "id": "validering",