[huangminghuang]

Summary

• Configure the depot emergency stop through native pull/clear permissions and action links, funding their RAM before creating them.
• Delegate panic and governance authority without replacing the Andon account's owner or active permission; declare the linked permission when invoking each action.
• Remove retired Andon configuration helpers and update emergency-stop and bucket-refill assertions to the current contract surface.
• Require SDK 1.0.95 or newer in every direct consumer so installations include the native Andon declarations.

Why

wire-sysio #662 changed Andon to native permission-based authorization, removing setpanic, addpuller, and the contract-managed panic/puller registry. The Tools bootstrap still called those removed actions and its flows read retired fields, making it incompatible with the merged contract.

This implements the native-permission setup already documented in the production bootstrap guide. Privileged syndication pulls continue through the existing active permission.

Validation

• Focused bootstrap, Andon/system action, and syndication helper suites: 82 tests pass.
• Emergency-stop and rate-limit unit suites: 50 tests pass, including valid and invalid cord reasons, incident sequences, elapsed-epoch refill, capacity, and epoch regression.
• The complete Tools workspace builds in an isolated checkout against published SDK 1.0.95, without sibling package overrides. The focused tests above pass against that registry installation. No live E2E pass is claimed.

Companion PRs

• wire-libraries-ts #100: merged SDK declarations for Sysio #662, published in SDK 1.0.95 through release #101.