feat: declare a risk tier on every command in the catalog

467 of the 1592 commands carried no `risk:`. An unset risk is read as
destructive by the agent approval gate, so half the catalog's write side sat
behind the same prompt — and, in HarfangLab's case, 39 pure lookups did too.
A gate that stops everything stops being read as a signal, which is the
argument already made for the toolkit and for sentinelone (df27876).

The catalog is now 1027 read, 261 safe_write, 304 destructive, with nothing
defaulted. The line follows the one sentinelone drew: impact on the estate,
not reversibility — isolate-agent is reversible and is the canonical
destructive example.

  read        only queries; changes nothing outside Riposte
  safe_write  additive or reversible inside the tool's own case/enrichment
              plane: comments, tickets, tags, alert statuses, threat-intel
              records, sandbox submissions, collection jobs, outbound messages
  destructive changes the estate or weakens a control: containment, blocklists
              and allowlists, exclusions and detection rules, every delete,
              identity and credential operations, code on a host, generic
              API escape hatches

Three calls that were not obvious, and are now applied throughout:

- Undoing a containment is tiered like the containment it lifts. Un-isolating
  a host or un-banning an IP mid-incident is its own decision, not a return to
  a neutral state. The catalog contradicted itself here — crowdstrike's
  lift_containment was destructive while harfanglab's deisolate_from_threat
  was safe_write — so deisolate_from_threat and unquarantine_file are
  re-tiered to destructive, the only two existing tiers this pass changes.
- Retrieving a live secret is destructive: cyberark get_password, delinea
  get_secret, vault read_secret, beyondtrust get_credential. It is a GET, but
  the tier describes the stake, not the HTTP verb.
- Sending outward to humans stays safe_write — slack, teams, twilio, telegram,
  mail. Irreversible, but it is the collaboration plane, not the estate.

An object created but not yet referenced by a rule is safe_write; editing one
a rule already reads is destructive. That is why fortigate create_address and
panos create_custom_url_category are safe_write while update_address_group and
edit_custom_url_category are not.

The template and README never documented the field, which is how 467 commands
came to omit it. Both now carry the tier table and these rules, so the next
integration declares a tier instead of inheriting one.

111 packages get a MINOR bump and a changelog entry: an instance compares
versions to offer an update, so an unbumped manifest would leave the tiers
sitting in the catalog and never reaching the estates that need them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/gmail/manifest.yaml

@@ -1,8 +1,8 @@
 id: gmail
 name: Gmail
-version: 1.0.0
+version: 1.1.0
 description: "Gmail API + Directory API — mailbox search/read/send/trash/labels, attachments retrieval, vacation auto-reply, filters, forwarding addresses, delegates, and Workspace user administration; message ingestion (get_incidents) with an OCSF mapper; service-account auth with domain-wide delegation. Runs on a remote engine. Requires the Python 'PyJWT' and 'cryptography' libraries on the engine host (pip install pyjwt cryptography)."
-changelog: "1.0.0 — Initial release: mailbox commands (search, get mail/thread, send with attachments, trash/permanent delete, label moves, attachments download, labels list), vacation auto-reply get/set, mail filters (add/list/remove), forwarding addresses and auto-forwarding, delegates, Workspace user administration (list/get/create/delete, password reset, directory visibility), and message ingestion with a bundled OCSF mapper."
+changelog: "1.1.0 — Declare the risk tier on the 15 commands that carried none: 4 safe_write, 11 destructive. An unset risk is read as destructive by the agent approval gate, so the 4 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: mailbox commands (search, get mail/thread, send with attachments, trash/permanent delete, label moves, attachments download, labels list), vacation auto-reply get/set, mail filters (add/list/remove), forwarding addresses and auto-forwarding, delegates, Workspace user administration (list/get/create/delete, password reset, directory visibility), and message ingestion with a bundled OCSF mapper."
 category: email
 
 # Authentication: Google service account with domain-wide delegation.
@@ -84,6 +84,7 @@ commands:
   - id: send_mail
     name: gmail-send-mail
     description: "Send an email from the impersonated mailbox — plain text and/or HTML body, optional single attachment (base64), reply threading via In-Reply-To/References."
+    risk: safe_write
     inputs_schema:
       properties:
         to: { type: string, description: "Recipients, comma-separated" }
@@ -103,6 +104,7 @@ commands:
   - id: delete_mail
     name: gmail-delete-mail
     description: "Move a message to Trash, or delete it permanently (bypasses Trash) when permanent is true."
+    risk: destructive
     inputs_schema:
       properties:
         message_id: { type: string, description: "Gmail message ID" }
@@ -113,6 +115,7 @@ commands:
   - id: move_mail
     name: gmail-move-mail
     description: "Add and/or remove labels on a message (move between folders — e.g. remove INBOX, add SPAM or a quarantine label)."
+    risk: safe_write
     inputs_schema:
       properties:
         message_id: { type: string, description: "Gmail message ID" }
@@ -154,6 +157,7 @@ commands:
   - id: autoreply_set
     name: gmail-autoreply-set
     description: "Enable, update or disable the mailbox's vacation auto-reply."
+    risk: safe_write
     inputs_schema:
       properties:
         enable: { type: boolean, description: "Enable the auto-reply (default true; false disables it)" }
@@ -172,6 +176,7 @@ commands:
   - id: add_filter
     name: gmail-add-filter
     description: "Create a mail filter on the mailbox (criteria: from/to/subject/query/has_attachment; actions: add/remove labels, forward)."
+    risk: destructive
     inputs_schema:
       properties:
         from: { type: string, description: "Criteria — sender address" }
@@ -197,6 +202,7 @@ commands:
   - id: remove_filter
     name: gmail-remove-filter
     description: "Delete a mail filter by ID."
+    risk: destructive
     inputs_schema:
       properties:
         filter_id: { type: string, description: "Filter ID (from gmail-list-filters)" }
@@ -208,6 +214,7 @@ commands:
   - id: forwarding_add
     name: gmail-forwarding-add
     description: "Register a forwarding address on the mailbox (Google may require verification before it becomes usable)."
+    risk: destructive
     inputs_schema:
       properties:
         forwarding_email: { type: string, description: "Forwarding address to register" }
@@ -226,6 +233,7 @@ commands:
   - id: forwarding_remove
     name: gmail-forwarding-remove
     description: "Delete a forwarding address from the mailbox."
+    risk: destructive
     inputs_schema:
       properties:
         forwarding_email: { type: string, description: "Forwarding address to remove" }
@@ -235,6 +243,7 @@ commands:
   - id: forwarding_update
     name: gmail-forwarding-update
     description: "Enable auto-forwarding of the mailbox to a verified forwarding address, with a disposition for the forwarded copy."
+    risk: destructive
     inputs_schema:
       properties:
         forwarding_email: { type: string, description: "Verified forwarding address to auto-forward to" }
@@ -247,6 +256,7 @@ commands:
   - id: delegate_add
     name: gmail-delegate-add
     description: "Grant a delegate access to the mailbox (delegate can read, send and delete on the owner's behalf)."
+    risk: destructive
     inputs_schema:
       properties:
         delegate_email: { type: string, description: "Delegate's email address (same Workspace domain)" }
@@ -256,6 +266,7 @@ commands:
   - id: delegate_remove
     name: gmail-delegate-remove
     description: "Revoke a delegate's access to the mailbox."
+    risk: destructive
     inputs_schema:
       properties:
         delegate_email: { type: string, description: "Delegate's email address to revoke" }
@@ -289,6 +300,7 @@ commands:
   - id: create_user
     name: gmail-create-user
     description: "Create a Workspace user (Directory API)."
+    risk: destructive
     inputs_schema:
       properties:
         email: { type: string, description: "New user's primary email address" }
@@ -300,6 +312,7 @@ commands:
   - id: delete_user
     name: gmail-delete-user
     description: "Delete a Workspace user (Directory API)."
+    risk: destructive
     inputs_schema:
       properties:
         user_key: { type: string, description: "User's primary email, alias email or unique ID" }
@@ -308,6 +321,7 @@ commands:
   - id: set_password
     name: gmail-set-password
     description: "Reset a Workspace user's password (Directory API) — a common containment step for a compromised account."
+    risk: destructive
     inputs_schema:
       properties:
         user_key: { type: string, description: "User's primary email, alias email or unique ID" }
@@ -317,6 +331,7 @@ commands:
   - id: hide_user
     name: gmail-hide-user
     description: "Set a Workspace user's global directory visibility (Directory API)."
+    risk: safe_write
     inputs_schema:
       properties:
         user_key: { type: string, description: "User's primary email, alias email or unique ID" }