refactor(core): migrate tool context runtime owner

[limityan]

Summary

• Move provider-neutral tool context custom-data materialization and prompt-safe context facts projection into tool-runtime.
• Keep concrete ToolUseContext, runtime handles, workspace/path policy enforcement, checkpoints, cancellation hooks, and product tool entrypoints in bitfun-core.
• Keep DeepReview-specific context data in its existing runtime/domain owner; tool-runtime only merges provider-neutral extension custom data.
• Add boundary rules, self-test coverage, focused Rust tests, and concise plan/completed-doc updates for the new owner boundary.

Boundary and risk notes

• No functional behavior change is intended. Existing defaults are preserved: missing image-support metadata still defaults to supported, invalid context vars are ignored, and delegation policy defaults remain top-level.
• Extension custom data cannot override runtime-owned values such as delegation policy, turn index, transport flags, or primary model image-support facts.
• New dependencies for tool-runtime are limited to lower/stable contract crates: bitfun-agent-tools and bitfun-runtime-ports.
• bitfun-agent-runtime does not depend on tool-runtime; DeepReview domain policy is not pushed into the low-level tool execution crate.

Validation

• pnpm run fmt:rs
• cargo test -p tool-runtime context
• cargo test -p tool-runtime
• cargo test -p bitfun-agent-runtime
• cargo test -p bitfun-core --features product-full tool_context_runtime
• cargo check -p bitfun-core --no-default-features
• cargo check -p bitfun-core --features product-full
• node --test scripts/check-core-boundaries.test.mjs
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• cargo metadata --no-deps --format-version 1
• cargo tree -p bitfun-agent-runtime --depth 1
• cargo tree -p tool-runtime --depth 1
• git diff --check