fix(cli): keep the core-web overlay at its documented two-tool surface

The opt-in `core-web.cordis.yml` profile promises "exactly persistent
`bash` plus `str_replace_editor`" (its header comment and `apps/cli/
README.md`), but the base registration of `tool-subagent-list-agents`
(added with the durable child catalog) was not disabled by the overlay,
so the profile actually exposed `bash`, `str_replace_editor`, and
`list_agents`. The assembled snapshot was updated to accept the third
tool, which ratified the contract break instead of fixing it.

Disable `tool-subagent-list-agents` in the overlay and restore the
snapshot's expected tool registry to the documented two tools.

apps/cli/config/core-web.cordis.yml

@@ -28,6 +28,9 @@
 - id: tool-subagent-control
   disabled: true
 
+- id: tool-subagent-list-agents
+  disabled: true
+
 - id: tool-subagent
   disabled: true