feat(tools): let one agent choose its tool presentation, and ship code

Code Mode was a deployment-wide field on the host `tools` row: a
deployment ran every session that way or none. The obvious product
shape — 代码模式 beside 标准/极简/创造 in the preset picker — had
nothing to hang on.

The registry itself cannot move into a preset; the agent loop's
scheduler, the api-proxy's presenters, and every tool plugin are its
consumers. So split the registry from its projection: `presentAs(mode)`
writes one cell on the calling agent's scope layer, exactly as
`restrict()` does, and the three reads that decided presentation take
that scope's mode instead of the service's. The config `mode` becomes
the default agents shadow rather than a process-wide fact.

Two consequences are load-bearing. `run_code` now enters a view only
for scopes whose own mode presents it — a native agent must not find it
dispatchable because another agent in the process does — and the
reserved name holds whatever the configured mode, since any agent may
select a code mode later.

`dsh-agent-tool-mode` is the row a preset carries to declare this. A
code mode waits for the host's `codeRuntime` rather than assuming it,
so a runtime-less deployment fails the preset at mount, naming the
row, instead of at the session's first request.

The shipped `code` preset is `standard` plus that row, ordered second.

apps/cli/tests/web-agent-presets.spec.ts

@@ -88,7 +88,7 @@ describe('the shipped Web composition', () => {
   it('supplies both shipped presets, and only those, from the system root', async () => {
     const listed = await ctx.agentPresets.list()
 
-    expect(listed.map(preset => preset.id).sort()).toEqual(['cordis', 'minimal', 'standard'])
+    expect(listed.map(preset => preset.id).sort()).toEqual(['code', 'cordis', 'minimal', 'standard'])
     expect(listed.every(preset => preset.trust === 'system')).toBe(true)
     expect(ctx.agentPresets.defaultId).toBe('standard')
   })
@@ -174,6 +174,38 @@ describe('the shipped Web composition', () => {
     }
   })
 
+  it('presents `code` as Code Mode without disturbing a native session beside it', async () => {
+    const coded = await ctx.agents.create({
+      sessionId: SessionId('preset-code'),
+      setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'code').then(() => undefined),
+    })
+    const native = await ctx.agents.create({
+      sessionId: SessionId('preset-code-native'),
+      setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'standard').then(() => undefined),
+    })
+    try {
+      // One tool reaches the MODEL: the transport. The registry's catalog for
+      // this agent is unchanged — a code mode collapses the presentation, not
+      // the capabilities — so the assembly is what carries the claim.
+      const assembly = await ctx.systemPrompt.assemble({ scope: coded.agent })
+      expect(assembly.tools.map(tool => tool.name)).toEqual(['run_code'])
+      expect(toolNames(ctx, coded.agent)).toContain('str_replace_editor')
+      const sdk = assembly.sections.find(section => section.name === 'tools:sdk')?.text ?? ''
+      expect(sdk).toContain('str_replace_editor')
+      expect(sdk).toContain('web_search')
+
+      // The presentation is this agent's alone: the deployment default is
+      // native, and the session composed from `standard` still sees it.
+      const nativeAssembly = await ctx.systemPrompt.assemble({ scope: native.agent })
+      expect(nativeAssembly.tools.map(tool => tool.name)).toContain('bash')
+      expect(nativeAssembly.tools.map(tool => tool.name)).not.toContain('run_code')
+      expect(nativeAssembly.sections.some(section => section.name === 'tools:sdk')).toBe(false)
+    } finally {
+      await native.dispose()
+      await coded.dispose()
+    }
+  })
+
   it('keeps the self-referential toolset out of every other preset', async () => {
     const handle = await ctx.agents.create({
       sessionId: SessionId('preset-no-cordis'),