feat(agent): add tool availability controls

[hoalongnatsu]

What does this PR do?

Adds DC5's availability-first Tool catalog for Chat and Analyze. OSS now owns a
complete grouped catalog, server-resolved requirements and health, durable
per-org/per-agent toggles, model filtering, admin APIs, and the /agent/tools
workspace.

The catalog enumerates 22 known tools across versus, common, and k8s. The
five Kubernetes entries are requirement metadata only; this PR does not add
Kubernetes reads or data-source binding.

Why?

Tools were previously omitted silently when a dependency was missing. Operators
could not discover the complete tool surface or tell whether a tool was disabled,
unconfigured, unhealthy, or license-gated.

DC5 creates one server-owned state machine shared by the API, UI, toggle
preconditions, Chat registration/seeding, and Analyze registration. This makes
tool availability truthful before DC6 adds Kubernetes capabilities and DC7 adds
source binding.

How to test

Backend

cd versus-incident

go build ./...
go vet ./...
go test -race -p 1 ./...

Focused checks:

go test -race ./pkg/agent/ai/tools ./pkg/agent/ai/chat \
  ./pkg/agent ./pkg/controllers ./cmd

UI

cd versus-incident/ui

npx tsc -b --pretty false
npm run lint
npm test
npm run build
npx playwright test --config tests/e2e/playwright.config.ts \
  tests/e2e/agent-tools.spec.ts

Validated results:

• OSS build, vet, and full race suite pass.
• UI typecheck, lint, and production build pass.
• All 68 Vitest files / 796 tests pass.
• Focused navigation/admin tests pass 32/32.
• The production UI build transforms 2,287 modules.
• Enterprise companion build, vet, and tests pass.

Manual checks:

1. Open /agent/tools while the agent is disabled and confirm the catalog is
   readable.
2. Switch between Chat and Analyze and disable a satisfied tool for only one
   agent.
3. Confirm the next model tool list and new-session seed honor that setting while
   the other agent remains unchanged.
4. Attempt to enable a missing Kubernetes or source-backed tool and confirm HTTP
   409 with a bounded actionable reason.
5. Confirm groups render in versus, common, k8s order.
6. Confirm Runbooks remains reachable with its independent setup hint.
7. With shared CAS storage, update one replica and confirm the next turn on
   another replica uses the new policy.

The Agent Tools Playwright spec is tracked and both desktop/mobile cases are
discovered. Its real-server rerun remains a release-process condition after the
separate gateway-session/authentication work stabilizes: current attempts stop
in the authentication helper before any Tool catalog assertion.

Staging note

The workspace contains concurrent gateway-session/authentication changes that
are not part of DC5. Stage only DC5 hunks in mixed files such as
ui/src/lib/api.ts, cmd/main.go, Enterprise's composition root, and operator
documentation. Exclude auth behavior and generated tsbuildinfo, Playwright
reports/results/cache, and tests/e2e/screenshots/. Verify the isolated staged
tree with the commands above.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

Checklist

• go test ./... passes locally
• go vet ./... is clean
• Code is gofmt'd
• Added or updated tests for the change
• Updated user-facing docs under src/ if behavior changes
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies (or justified in the description)

ROADMAP.md is unchanged because DC5 is tracked in
plans/status/devops-chat-implementation.md rather than the public roadmap.