feat(tools): bound+frame tool results, spill full output to CAS, tool_output retrieval

Tool results injected into model context are now consistently framed and
globally bounded. Success output over the floor (TOOL_RESULT_MAX_CHARS=8000)
is head/tail-truncated with a marker naming a retrieval ref; the full raw
output spills to the artifact store (CAS) and its hash is recorded on the
ToolReceipt (fullOutputHash) in the event log. Agents recover the full text
via the new read-only tool_output(ref=...) tool.

- SessionOrchestrator: frameTruncatedToolResult + renderToolResult; char-cap
  head/tail so a single pathological long line can't defeat the bound.
- ToolReceipt.fullOutputHash (additive, nullable).
- ToolOutputTool (Tier T1, no fs capability) resolves ref -> full bytes.
- Wired via extraTools in Main.kt; tool_output added to ALWAYS_AVAILABLE_READ_TOOLS.
- Failure path keeps ERROR:/FATAL: prefixes (all-rejected breaker dependency).

Tests: FrameTruncatedToolResultTest, ToolOutputToolTest.

core/events/src/main/kotlin/com/correx/core/events/events/ToolReceipt.kt

@@ -19,4 +19,8 @@ data class ToolReceipt(
     val tier: Tier,
     val timestamp: Instant,
     val diff: String? = null,
+    // Artifact-store hash of the FULL tool output when it was truncated for model context (the
+    // outputSummary above is a bounded preview). Null when nothing was truncated. Lets an agent
+    // retrieve everything via the tool_output tool without bloating the event log with raw output.
+    val fullOutputHash: String? = null,
 )