feat(tools): route and redact fetch tool results

[konglyyy]

Summary

• dispatch acornops_fetch through the existing platform-function client
• give Fetch reads a bounded client timeout that exceeds the control-plane executor timeout
• redact Fetch query values and response data from durable run events
• add contract and regression coverage for routing, timeout, and redaction

Validation

• task validate: 193 tests passed
• Ruff, contract, and harness checks passed
• workspace platform-contract check passed

Related PRs and merge order

1. control-plane — feat(agents): add secure fetch native tool control-plane#17
2. execution-engine (this PR) — feat(tools): route and redact fetch tool results #6
3. management-console — feat(agents): configure fetch native tool management-console#19
4. docs-website — docs(tools): document fetch native tool docs-website#12

Documentation

Updates the execution-engine contract manifest. User-facing documentation is delivered in the related docs PR.

Residual risk

No new transport is introduced; Fetch continues through the existing platform-function boundary. The timeout margin assumes the control-plane keeps its documented 15-second Fetch deadline.