Artifact copy/read block messages consolidated, plus a new check for a headless capability flag
The code that builds the error message shown when a deny rule blocks reading or copying from an artifact was consolidated into one shared helper, which now produces one of three phrasings depending on the situation: "Copying from this artifact is", "Artifact reads are", or "Reading this artifact is" blocked by a rule. A separate new helper also checks whether a fetched artifact's capabilities include a headless comment flag.
This is mostly an internal cleanup that produces more precise, situation-specific wording when an artifact read or copy is blocked by a permission rule.
The finding does not say what the new `headless` capability check is used for beyond being checked.
Changed plain WebFetch deny and ask rules to no longer apply to Artifact tool reads and updates; use an Artifact rule (or…