Risky behavior now covered

Workspace and session tool-calling settings decide whether a turn uses native tool search / programmatic tool calling or the local harness. Two gaps in that path were untested:

• Config merge accepts bool-like strings and the local strategy alias, ignores invalid values so the parent tier still applies, and a partial patch must not wipe sibling fields. clearToolCalling must also delete legacy providerOptions tool-calling keys so a reload inherits the user tier instead of turning the feature back on.
• cowork/session/defaults/apply must reject a patch that contains a cloud baseUrl, apiKey, or headers override (a non-loopback LM Studio URL included) before any tool-calling change is stored. Live session overrides must drop those endpoint fields, ignore invalid strategy/bool values without clobbering stored settings, and clear the mirrored provider-option keys when tool calling is cleared. A loopback lmstudio.baseUrl stays allowed.

Test files added/updated

• crates/cowork-config/tests/tool_calling_config_persistence.rs
• crates/cowork-server/src/registry.rs (unit tests only)

No production behavior changes.

Why these tests materially reduce regression risk

A bad merge would silently enable native code execution on a model that should stay on the harness, or keep using a client-chosen endpoint with the saved API key. These tests pin the precedence and the rejection boundary: explicit workspace values beat both legacy providerOptions and the user tier, invalid values fall through, and endpoint-bearing defaults patches fail closed.

Validation

• cargo test -p cowork-config --test tool_calling_config_persistence (2 passed)
• cargo test -p cowork-server --lib registry::tests (3 passed)
• cargo clippy -p cowork-config --test tool_calling_config_persistence -- -D warnings
• cargo clippy -p cowork-server --all-targets -- -D warnings
• cargo fmt --all -- --check on the touched files