Scoped tool permissions

Tools are allow-listed per agent configuration. A call cannot invoke a tool outside its list.