feat: land additive managed tool mediation

[mostlydev]

Summary

• update the cllama submodule to the merged additive managed/native tool mediation change
• document the additive mediation contract and fail-closed boundaries
• add a live OpenClaw spike that validates native-tool access followed by managed-tool access in one session

Testing

• go test ./internal/proxy/... (in cllama/)
• go test -tags spike ./cmd/claw -run ^
• go test -tags spike ./cmd/claw -run TestSpikeOpenClawAdditiveToolsLive -count=1 -v

Closes #151.