feat(goose): complete v1.49 phase3 closeout gates and context fusion plan

Expand Goose v1.49 smoke coverage (memory chat, portal resume, page e2e,
multiturn provider), add canary memory policy lock, refresh baselines, and
ignore one-off evidence artifacts. Document headroom-based context runtime
fusion plan; include auth, scheduled-task, and wechat intent fixes on branch.

Co-authored-by: Cursor <cursoragent@cursor.com>

user-auth.test.mjs

@@ -482,6 +482,43 @@ test('agent session policy preserves sandbox root and exposes workspace ref meta
   );
 });
 
+test('unrestricted admin agent session policy still injects sandbox-fs like regular users', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-admin-agent-policy-'));
+  const adminRow = {
+    id: 'admin-john',
+    username: 'john',
+    slug: 'john',
+    email: 'john@example.com',
+    display_name: 'John',
+    role: 'admin',
+    status: 'active',
+    plan_type: 'free',
+    workspace_root: path.join(root, 'MindSpace', 'admin-john'),
+    balance_cents: 0,
+    tokens_used: 0,
+  };
+  const auth = createUserAuth(createAgentPolicyPool(adminRow), {
+    h5Root: root,
+    persistSessions: false,
+    env: {
+      GOOSED_SANDBOX_PUBLISH_ROOT: '/srv/goosed-mindspace',
+      GOOSED_MCP_NODE_PATH: '/usr/local/bin/node',
+      GOOSED_MCP_SERVER_PATH: '/opt/portal/mindspace-sandbox-mcp.mjs',
+      GOOSED_MCP_CONTAINERIZED: '1',
+      H5_PUBLIC_BASE_URL: 'http://127.0.0.1:18131',
+    },
+  });
+
+  const policy = await auth.getAgentSessionPolicy(adminRow.id, { sessionId: 'session-admin' });
+  assert.equal(policy.unrestricted, true);
+  const sandboxFs = policy.extensionOverrides?.find((item) => item.name === 'sandbox-fs');
+  assert.ok(sandboxFs, 'admin MindSpace sessions must include sandbox-fs');
+  assert.ok(
+    sandboxFs.available_tools.includes('generate_image'),
+    'sandbox-fs must expose generate_image for qwen-image page flows',
+  );
+});
+
 test('admin capabilities include granted platform skills', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-admin-skills-'));
   await fs.mkdir(path.join(root, 'skills', 'product-campaign-page'), { recursive: true });