feat(routines): enable tool access in lightweight routine execution (#257) (#730)

* Rebase onto staging

* fix(routines): prevent autonomy-escalation in lightweight routines

  - Add ROUTINE_TOOL_DENYLIST to block routine_create/update/delete/fire
    and restart from being callable by lightweight routines
  - Deduplicate sentinel logic by reusing handle_text_response() in the
    no-tools path
  - Filter tool definitions sent to LLM to only include callable tools,
    avoiding wasted tokens on tools that would be rejected

src/testing/mod.rs

@@ -1067,6 +1067,8 @@ mod tests {
                 prompt: "Check status".to_string(),
                 context_paths: vec![],
                 max_tokens: 500,
+                use_tools: false,
+                max_tool_rounds: 3,
             },
             guardrails: RoutineGuardrails {
                 cooldown: std::time::Duration::from_secs(60),
@@ -1198,6 +1200,8 @@ mod tests {
                 prompt: "test".to_string(),
                 context_paths: vec![],
                 max_tokens: 100,
+                use_tools: false,
+                max_tool_rounds: 3,
             },
             guardrails: RoutineGuardrails {
                 cooldown: std::time::Duration::from_secs(0),