fix(core): keep execute tool cache stable

[rekram1-node]

Summary

• keep the native execute tool available when the visible Code Mode catalog is empty
• preserve explicit execute permission denial as the capability-off state
• durably instruct the model not to call execute while no Code Mode child tools are available
• cover empty, stable-empty, populated, unavailable, MCP permission, and canonical tool-order transitions

Testing

• bun typecheck in packages/core
• bun test in packages/core (1444 passed, 6 skipped)
• independent subagent code review with findings addressed