Add isolated SIP call tool, optional debug capture and split interface schemas

internal/config/agent_runtime.go

@@ -15,6 +15,7 @@ import (
 // AgentEnvironment is deployment-owned and is inspected without opening any
 // durable file, media adapter, credential or network connection.
 type AgentEnvironment struct {
+	Debug                bool
 	Mode                 string
 	AgentID              string
 	CellID               string
@@ -99,9 +100,7 @@ func LoadAgentEnvironment(mode string) (AgentEnvironment, error) {
 		*field.value = value
 	}
 	if mode == "nonprod-real" {
-		if settings.EvidenceRoot, err = get("AGENT_EVIDENCE_ROOT"); err != nil {
-			return AgentEnvironment{}, err
-		}
+		settings.EvidenceRoot = os.Getenv("AGENT_EVIDENCE_ROOT")
 		if settings.OSSAllowedHost, err = get("AGENT_OSS_ALLOWED_HOST"); err != nil {
 			return AgentEnvironment{}, err
 		}
@@ -122,9 +121,6 @@ func LoadAgentEnvironment(mode string) (AgentEnvironment, error) {
 		if !strings.HasPrefix(settings.HEPListen, "127.0.0.1:") || !localGRPCAddress(settings.HEPListen, false) {
 			return AgentEnvironment{}, errors.New("AGENT_HEP_LISTEN_ADDR must be an explicit IPv4 loopback address with a nonzero port")
 		}
-		if !filepath.IsAbs(settings.EvidenceRoot) {
-			return AgentEnvironment{}, errors.New("AGENT_EVIDENCE_ROOT must be absolute")
-		}
 		if os.Getenv("AGENT_MOCK_SCENARIO_FILE") != "" || os.Getenv("AGENT_MOCK_APPLIED_SIP_FILE") != "" {
 			return AgentEnvironment{}, errors.New("nonprod-real Agent cannot load isolated Mock fixtures")
 		}
@@ -140,6 +136,14 @@ func LoadAgentEnvironment(mode string) (AgentEnvironment, error) {
 	return settings, nil
 }
 
+// ValidateDebug only requires external capture configuration when explicitly enabled.
+func (s AgentEnvironment) ValidateDebug() error {
+	if s.Debug && s.Mode == "nonprod-real" && !filepath.IsAbs(s.EvidenceRoot) {
+		return errors.New("AGENT_EVIDENCE_ROOT must be absolute when --debug/-D is enabled")
+	}
+	return nil
+}
+
 func localGRPCAddress(raw string, allowZeroPort bool) bool {
 	host, port, err := net.SplitHostPort(raw)
 	if err != nil {