feat(runtime): bucket ungrouped native tools by categoryHint in tool search

[liugddx]

What

Deferred tool discovery (tool_search) collapsed every ungrouped native tool into a single opaque other group in the searchable inventory. When the model browses the inventory it sees one undifferentiated other bucket with no capability signal to steer by.

This buckets ungrouped native tools by the permission categoryHint (ToolCategory) already present on the bound tool, producing a compact capability-family map instead:

categoryHint	family id	label
read / file_write / fs_destructive	filesystem	Filesystem & search
shell_safe / shell_unsafe / privileged / git_destructive	shell	Shell & processes
web_read / network_send	web	Web & network
browser	browser	Browser automation
computer_use	computer_use	Computer use
client_capability	client_capability	Client capabilities
subagent	agents	Agent orchestration

Why it's safe

• Reads metadata already on the bound tool — no tool schema is loaded, nothing is fetched.
• Permission classification is untouched: grouping is presentation-only. Every native tool stays gated + deferred exactly as before.
• A caller-supplied group with a colliding id keeps precedence: family members merge into the explicit group rather than overriding it.
• Tools with no hint (or custom_tool) still fall back to other — no behavior change for them.

Tests

Two regression tests added to tool-availability.test.ts:

1. buckets ungrouped native tools into capability families by categoryHint — asserts distinct hints land in distinct families, custom_tool/hint-less fall back to other, family ids surface in the searchable inventory, and every tool stays gated + deferred.
2. a caller-supplied group keeps precedence over a categoryHint family — an explicit group claims a tool; only the remaining hinted tool is family-bucketed; no other.

Causal proof (fail-without / pass-with): with the production hunk temporarily reverted to the old "all → other" logic, exactly these two new tests fail (bySource.agents/web/computer_use come back undefined); with the fix restored, all 20 tests in the suite pass. So the tests gate on this logic rather than passing vacuously.

Part of #4267. Closes #4353.