fix(cli): keep the core-web overlay at its documented two-tool surface

The opt-in `core-web.cordis.yml` profile promises "exactly persistent
`bash` plus `str_replace_editor`" (its header comment and `apps/cli/
README.md`), but the base registration of `tool-subagent-list-agents`
(added with the durable child catalog) was not disabled by the overlay,
so the profile actually exposed `bash`, `str_replace_editor`, and
`list_agents`. The assembled snapshot was updated to accept the third
tool, which ratified the contract break instead of fixing it.

Disable `tool-subagent-list-agents` in the overlay and restore the
snapshot's expected tool registry to the documented two tools.

apps/cli/config/core-web.cordis.yml

@@ -28,6 +28,9 @@
 - id: tool-subagent-control
   disabled: true
 
+- id: tool-subagent-list-agents
+  disabled: true
+
 - id: tool-subagent
   disabled: true
 

apps/web/tests/core-web-profile.snapshot.ts

@@ -72,7 +72,6 @@ describe('core Web profile', () => {
         "tools": [
           "bash",
           "str_replace_editor",
-          "list_agents",
         ],
       }
     `)