Add Tools V2 (Orchestrate): a composable tool engine alongside V1

[shellicar]

Summary

• Adds Orchestrate, a tool-calling system that composes registered tools into pipelines (|/&&/||), gated by a unified path/tool policy.
• Ports most of the V1 catalogue: file tools, Program, Memory, History, Skill, GitHub/AzureDevOps PR tools, AzCli, and the four TypeScript tools.
• V1 tools stay live. Only Pipe was retired, its job being covered by the new stages.
• A stage can name its output with captureAs, and a command in a later stage reads it from the environment it runs under, so a credential reaches that command without passing through the model.
• A stage is judged on what it will really do: every variable resolved and every path settled, so a -rf or a path that arrives in a variable is decided on as itself.
• An approval request carries the stage as the caller wrote it, since the request is published whether or not it is granted, so a refused call exposes nothing.
• A piped stage streams into the next one, so Find | Head stops looking once enough has been found.
• A stage runs ahead of whoever is reading it by at most one buffer and then waits, the way a process waits on a full pipe.
• A producer whose reader stops is stopped with it, and reports the signal it ended on rather than being called a failure.
• Anything held whole is bounded: an approval batch and an Xargs argument list both stop the producer instead of growing, and the stage they were collected for does not run.
• Program no longer kills a command for producing more than a fixed number of lines.
• A policy path pattern is absolute: a leading glob means anywhere, and a pattern that names neither a place nor a glob is refused when the policy loads.
• A stage can be fed by an Xargs stage, which appends the piped values to the argument list the receiving tool declares.
• A pipeline is checked before it runs, so a pipe into a tool that cannot read one is refused with the correction named instead of quietly producing nothing.
• Each stage reports how much it produced, and why it did not run when that is the answer.
• Program runs under the environment provider, so a V2 exec gets the same credential stripping as a V1 one.
• Every V2 tool_use in a round runs through one shared per-batch scope, so tools needing a live resource get one instance per round.
• ESC now cancels a running Orchestrate/Program call directly, and a second ESC cancels the query even when the round has moved on to its V1 tools.
• Every tool_use is answered, including the V2 blocks of a round that was cancelled before it started.
• A call naming several paths is judged one path at a time and takes the strictest verdict, so a permitted path can no longer carry a forbidden one through with it.
• Approval requests show where the stage sits in the pipeline and correlate to the tool_use block they belong to.
• The shipped policy allows reads and listings inside the working directory, and decides nothing else.
• The TypeScript tools no longer hang on a symbol whose documentation contains a non-ASCII character.