feat(streaming): native tool calls during SSE streaming - #971

Decouple native tool-call support from the streaming path. Previously the
agent loop disabled native tools whenever a stream callback was attached,
forcing tools into a prompt-injection format that some models could not
reliably emit. The streaming protocol (StreamChunk / StreamChatResult) also
had no field to carry tool calls, so even if a provider parsed them they
were dropped at the agent boundary.

Changes:

- providers/root: add `tool_calls` to StreamChatResult and a
  `supportsStreamingNativeTools()` vtable slot, defaulting false.
- providers/sse: add a ToolCallAccumulator that parses `delta.tool_calls`
  (OpenAI-compatible) across SSE chunks and emits a complete tool_calls
  slice on the final StreamChatResult.
- providers/{openai,compatible}: opt in to streaming native tools.
- providers/{router,reliable}: delegate the capability conservatively.
- providers/anthropic: explicitly report false (Anthropic streaming
  tool-use uses a different event shape and is left for a follow-up).
- agent/root: gate native tools on `supportsStreamingNativeTools()` when
  streaming (not on `!is_streaming`), and propagate
  `stream_result.tool_calls` into the agent loop instead of dropping it.

Adds regression tests asserting native tools are requested during streaming
when the provider advertises the capability, and that tool_calls emitted on
the streaming path reach the agent loop.

Validation: zig build test --summary all → 7362/7371 passed (9 skipped),
0 failures, 0 leaks.

Addresses the review findings on nullclaw#971.

P1 -- a truncated stream could produce an executable tool call.
`toOwnedToolCalls` completed any slot that had a name, substituting
`{}` when no argument deltas had arrived. A curl timeout or nonzero
exit after a tool name but before its arguments therefore yielded a
call the agent would run with invented input. Two changes:

- `ToolCallSlot.saw_arguments` records that an `arguments` key actually
  arrived, even when its value was the empty string, so "nothing
  arrived" is no longer indistinguishable from "this call takes no
  arguments". A slot is complete only when it has a name and
  `saw_arguments`; the `{}` substitution is gone.
- `finalizeStreamResultWithToolCalls` takes a `tool_calls_trusted`
  flag. The three recovery paths (child wait error, nonzero curl exit,
  abnormal termination) pass false, so salvaged text is still returned
  but no tool call is executed. Only the clean-exit path passes true.

P1 -- capability was asked of the wrong provider. The router consulted
`default_model` while `streamChatImpl` resolves the requested model, and
the failover wrapper consulted only `inner` while `streamChatImpl` can
select an explicit extra or vision provider. With an OpenAI default and
an Anthropic request, native schemas were enabled against an
implementation that intentionally cannot recover native calls.

Added `supports_streaming_native_tools_for_model` to the provider
vtable, mirroring the existing `supports_vision_for_model` precedent,
and wired the two agent call sites to ask about `turn_model_name` -- the
model the turn will actually use. The router resolves the requested
model; the failover wrapper mirrors `streamChatImpl`'s own selection
via `resolveProviderTarget`, since vision selection needs the request
and is not available at this call site.

P2 -- tool calls from different choices were merged. Text comes from
choices[0] but the accumulator visited every choice while keying slots
only by tool-call index, so a two-choice response with index 0 in both
concatenated their argument strings into
`{"path":"a"}{"path":"b"}`, pairing one choice's id with another's
function name. The accumulator now reads the same choice as the text.

P2 -- a failed allocation left a dangling slot. The repeated function
name freed the old value before the fallible duplicate, so on OOM the
slot pointed at released storage and the deferred cleanup freed it
again. The replacement is now duplicated before the old value is
released. Related: `appendFromJsonPayload` swallowed
`error.OutOfMemory` from the JSON parser as a malformed event; that is
now propagated, so an allocation failure surfaces instead of silently
dropping argument fragments.