v2.11.1 — Function calling robustness fixes

Fixed

• --system-prompt replaces CLI default tools during function calling — prevents the agent from executing host tools instead of returning tool_calls
• tool_calls arguments not always valid JSON — wraps raw values when needed
• Only first <tool_calls> block parsed — now parses all blocks, limits to one per response
• Single-block restriction in tool prompt removed — allows multi-tool prompts
• <tool_result> tags leaked into response content — now stripped before returning
• Tool results processed even when last message is not tool role — only injects when last message has role: 'tool'
• Ephemeral sessions not cleaned up — one-shot sessions are now stopped immediately after response

Full Changelog: v2.11.0...v2.11.1