feat(claude): disallow built-in tools per session

[atsushi-ishibashi]

Closes #1832.

• Adds the adapter-neutral ACP_DISALLOWED_TOOLS launch contract, translated by the agentOS-owned Claude launcher into the Agent SDK's disallowedTools. Mirrors how ACP_APPEND_SYSTEM_PROMPT is handled: no adapter-specific policy enters the shared sidecar.
• Per-session by construction, since sessions.open({ env }) already forwards env to the adapter process and restores it with the durable session. Default (unset) keeps current behavior.
• Patches createSession, so the policy also applies to resumed, loaded, and forked sessions.
• Accepts a comma-separated list or a JSON array for names containing commas. A malformed value fails the adapter at startup with an error naming the variable instead of silently leaving the tools enabled.
• Tests cover parsing, meta merging, fail-fast on a bad value, and an end-to-end assertion that the named tools are absent from the tool schema actually sent to the model.
• Documents the option on the Claude Code agent page with a checked example region.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CxUv9z3CoRfN6FvWTdnzeC