fix(talents): pin access_tier/type against request override master
prepare_config merged request values over the talent definition, and while cwd was guarded, access_tier and type were not — a request body could raise a talent's access_tier (which selects tool capability) or change its type (which steers provider/model resolution), escalating privileges past the talent definition. Pin both from the definition, mirroring the cwd guard: a request value that conflicts raises. Pin on presence, not just value — access_tier is populated only for cogitate talents, so a request that introduces access_tier on a talent that declares none is itself rejected (and no None key is injected). Latent today (no shipped caller sets these), but the request arrives as a JSON body and remote dispatch paths exist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>