Host startup and runtime extension registrations.
Reject a backend route that violates host storage boundaries.
The sandbox check is deliberately shallow. Wrapping a filesystem backend
in another BackendProtocol implementation changes who owns that safety
contract, so dcode does not inspect arbitrary backend object graphs.
Validate late routes and flag graph-bound registrations for restart.
Expose tools registered after the agent graph was built.
