docs: explain managed tool list substitutions
Document dotfile-blocking defense layer, tool-repeat detection, execution summary logging, and Python execution feature