fix: allow provider-safe runtime tool names

[chubes4]

Summary

• allow client runtime tool declarations to use provider-safe unnamespaced names such as filesystem_write
• preserve explicit client source on those declarations
• add smoke coverage for provider-safe runtime tool normalization

Why

WP Codebox/Studio Web needs to expose browser runtime tools to OpenAI-compatible providers. Slash-namespaced runtime tools like client/filesystem-write satisfy the older runtime declaration shape but are rejected by OpenAI tool-name validation. This keeps the runtime-tool contract compatible with provider-safe names.

Testing

• php -l src/Tools/class-wp-agent-tool-declaration.php
• php -l tests/runtime-tool-policy-smoke.php
• git diff --check
• php tests/runtime-tool-policy-smoke.php
• php tests/tool-source-registry-smoke.php

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Root-cause inspection, code change, smoke coverage, and local verification; Chris remains responsible for review and merge.

[chubes4]

Updated this PR with the same-turn tool-call drain and multi-candidate extraction fixes used by the final Studio Web commerce proof.

Verification run locally:

• php -l src/Runtime/class-wp-agent-provider-turn-result.php
• php -l src/Runtime/class-wp-agent-conversation-loop.php
• php tests/conversation-loop-completion-policy-smoke.php
• git diff --check

This branch was included in the final end-to-end commerce eval, which passed and produced WooCommerce materialization evidence: valid products.json, WooCommerce installed/activated, and 4 products seeded.