core/cli: hand the trash switch to the tools

`[trash] enabled` now reaches `delete_path` through the bound instance's
workspace policy, the same channel `[agent] path_denylist` already travels: set
when the session state is built and re-read by `reload_config_from_disk`, so a
config reload in the middle of a chat changes the next delete too.

The policy flag is what `delete_path` consults, so a host that never sets it
gets the safe default (deletes go to the trash) instead of a silent no-op.

tests/test_tools/test_workspace.py

@@ -7,12 +7,14 @@ from plyngent.tools import (
     WorkspaceError,
     active_workspace_policy,
     check_command_allowed,
+    get_trash_enabled,
     get_workspace_root,
     mode_covers,
     parse_access_mode,
     resolve_path,
     set_command_denylist,
     set_path_denylist,
+    set_trash_enabled,
 )
 from plyngent.tools.context import SessionState, bind_session
 
@@ -55,6 +57,16 @@ def test_access_mode_parse_and_covers() -> None:
     assert not mode_covers(AccessMode.READ, AccessMode.WRITE)
 
 
+def test_trash_switch(workspace: object) -> None:
+    """Deletes go to the trash until a host clears the switch."""
+    del workspace
+    assert get_trash_enabled() is True
+    set_trash_enabled(enabled=False)
+    assert get_trash_enabled() is False
+    set_trash_enabled(enabled=True)
+    assert get_trash_enabled() is True
+
+
 def test_config_grant_modes(workspace: object, tmp_path_factory: pytest.TempPathFactory) -> None:
     del workspace
     outside = tmp_path_factory.mktemp("granted")