fix(python-sdk): make the minimal profile an explicit allowlist

Give the SDK JSON-RPC server a per-root tool filter and let deployments mark the configured persona as the complete system prompt. The checked-in minimal overlay now names only bash and str_replace_editor, so later global tools and unrelated guidance from dsh-base cannot appear implicitly.

Keep the shared SDK host services and packaged Web capability intact. Only workspace instructions, compaction, and the conflicting one-shot Bash row remain disabled. Unit coverage pins the configuration paths, and a real dsh profile smoke proves the assembled prompt and exact two-tool request.

scripts/smoke-python-runtime.py

@@ -985,23 +985,7 @@ def smoke_sdk_minimal(base_url: str, executable: Path, update_snapshots: bool) -
         sessions = dsh_home / "sessions"
         disabled = [
             "agent-instructions",
-            "skill-filesystem",
-            "tool-skill",
             "tool-bash",
-            "tool-jobs",
-            "tool-fs",
-            "tool-fs-search",
-            "tool-subagent-control",
-            "tool-subagent-list-agents",
-            "tool-subagent",
-            "tool-subagent-fork",
-            "tool-subagent-report",
-            "tool-workflow",
-            "tool-todo",
-            "tool-goal",
-            "tool-ralph",
-            "tool-web",
-            "plan-mode",
             "compaction-basic",
             "command-compact",
             "tool-result-pruner",
@@ -1013,6 +997,14 @@ def smoke_sdk_minimal(base_url: str, executable: Path, update_snapshots: bool) -
                     "includeHarnessIdentity": False,
                     "includeRuntimeContext": False,
                     "persona": "You are a helpful software engineer assistant.",
+                    "personaComplete": True,
+                },
+            },
+            {
+                "id": "sdk-jsonrpc-server",
+                "config": {
+                    "maxTokensAsSuccess": True,
+                    "toolFilter": {"allow": ["bash", "str_replace_editor"]},
                 },
             },
             *({"id": row_id, "disabled": True} for row_id in disabled),