fix(agent-core): omit empty tools and stop invalid request retries

[ShiboSheng]

Problem

Org's text-only final report could reach an OpenAI-compatible provider as tools: [] plus tool_choice: "auto". Strict providers reject that combination with HTTP 400, and the reliability wrapper repeated the same invalid request; the packaged baseline reproduced 11 rejected report requests over about 65.5 seconds.

Solution

• Build tool parameters once for streaming and whole-response requests. Omit both fields when the final tool list is empty, preserve normal tool and forced-selection behavior, and reject a missing forced tool before HTTP.
• Classify remaining compatible-provider HTTP 400 responses as InvalidRequest, retaining the status, parameter, and readable reason. Stop same-provider retries for that error while preserving fallback providers, modified-request recovery, and transient-error retries. Frontend conversion keeps the existing UNKNOWN code with isRetryable=false.
• Add HTTP-boundary tests, a loopback provider fixture, and packaged-app reproduction instructions. No queue policy, schema, dependency, or UI component changes are included.

Potential risks

• A gateway that uses HTTP 400 for a temporary fault will now fail fast on that provider. Its response remains visible for diagnosis; configured fallback providers are still eligible.
• A separate Org wake/finality gap appeared under near-instant scripted responses: after a completed member task, one fresh-session repeat remained running without a certificate or final report, and two later resume intents were cancelled. The user chose to address this separately, so repeated automatic recovery is not fully accepted by this PR.
• The company model service and Windows incident environment were unavailable locally. The macOS packaged-app checks used an isolated loopback provider and cannot establish their behavior.
• The macOS and Windows workspace Clippy CI jobs are blocked by a pre-existing deprecated AtomicUsize::fetch_update call in crates/search/src/code/commands/text_search.rs:27. The same line exists on develop and this PR does not change that file; CI's Rust 1.99 treats the deprecation as an error. This independent search-module fix should be handled separately before merging this PR.
• There is no persistence migration or destructive cleanup. Reverting this commit restores the previous request and retry behavior without deleting existing task output or certificates.

Verification

• On the unmodified base, streaming and whole-response HTTP contract regressions failed as expected; the packaged baseline produced 11 strict-provider HTTP 400 final-report responses.
• cargo test -p agent_core --lib (from src-tauri) — 3,772 passed, 4 ignored.
• cargo clippy --all-targets -- -D warnings (from src-tauri) — passed; the commit hook also passed scoped agent_core Clippy.
• pnpm run lint, pnpm run check:circular, and git diff --check — passed.
• Targeted Vitest run for AgentOrgFinalSummaryCard.test.ts, useSubmitMessage.test.ts, and useQueueDispatch.classify.test.ts — 31 passed.
• node --test scripts/dev/provider-fixture-server.test.cjs — 2 passed.
• pnpm run tauri:build:fast -- /tmp/org-empty-tools-fixed-app --instance 99 — packaged app built and exercised through its UI. Strict and lenient final reports omitted both tool fields; a report HTTP 400 caused one request, while HTTP 503 caused one retry then success. Also exercised Stop during a delayed response, retry of an existing failed report, real quit/restart without duplicate summary, and an ordinary agent shell-tool write/read.
• The additional rapid fresh-session repeat exposed the wake/finality gap described above. See scripts/dev/org-request-contract-verification.md for the local reproduction and limits. No user-visible UI component changed, so UI screenshots do not help review this request-contract change.
• GitHub CI: PR contract, secret scan, frontend, typed lint, dependency boundaries, queue authority, circular dependencies and CodeQL passed. Workspace Clippy on macOS and Windows failed on the unchanged search-module line above; macOS log and Windows log.