Managed tool mediation should preserve runner-native tools

[mostlydev]

Summary

When cllama mediates managed tools for a service, it currently replaces the runner's outbound tool surface and takes over the entire tool-call loop. That means OpenClaw and other drivers lose their own native tools for the request as soon as managed tools are present.

This is not acceptable operationally. Managed tools must be additive to driver-native tools, not a replacement for them.

Actual behavior

Current master behavior matches ADR-020's v1 exclusivity rule:

• injectManagedOpenAITools() overwrites outbound tools[] with managed tools only and drops tool_choice / parallel_tool_calls
• injectManagedAnthropicTools() similarly overwrites Anthropic tools
• once managed tools exist, handleManagedOpenAI() / handleManagedAnthropic() own the entire loop
• any non-managed tool call emitted by the upstream model is treated as unsupported and fed back as an error within the mediated loop

Net result: runner-native tools disappear or become unusable whenever managed mediation is active.

Expected behavior

Managed tools should compose with runner-native tools:

1. cllama preserves any runner-provided tool definitions and appends compiled managed tools.
2. If the model emits only runner-native tool calls, cllama passes them back to the runner unchanged.
3. If the model emits only managed tool calls, cllama executes them internally as it does today.
4. If the model emits both in the same response, cllama should fail closed with a precise error for now unless we can preserve semantics safely. Silent dropping or replacement is not acceptable.
5. Streaming compatibility must hold for both OpenAI-format and Anthropic-format requests.

Constraints / design notes

• This is a proxy/runtime change, not a single-driver config change. The fix must work for every driver that sends tool schemas through cllama.
• Managed tool traces and continuity state should continue to be recorded only for managed rounds.
• The runner's requested tool_choice should only be stripped when it targets an invalid managed/native combination; otherwise we should preserve it whenever safe.
• We need regression coverage for:
  • outbound merge of native + managed tools
  • native-only tool-call response pass-through under mediated mode
  • mixed managed/native tool-call response fail-closed behavior
  • Anthropic parity

Acceptance criteria

• An agent behind cllama with x-claw.tools still retains driver-native tools such as OpenClaw-provided tools.
• Managed tools remain invocable in the same request surface.
• No driver loses its pre-existing tools merely because managed tools are enabled.
• Tests cover OpenAI and Anthropic paths.