fix(core,config): wire ToolsConfig::enabled into tool-def gating

[bug-ops]

Summary

• [tools] enabled = false was deserialized into ToolsConfig::enabled but never consumed anywhere in zeph-core/zeph-tools/zeph-agent-tools, so setting it had no effect — tool definitions were still sent to the LLM and the model could still attempt tool calls.
• Added tools_enabled: bool to ToolState (manual Default impl defaulting true, since the struct previously derived Default which would have silently defaulted the bool to false), an Agent::with_tools_enabled(bool) builder method, and gated tool-definition construction in both production request-building paths: Agent::process_response_native_tools (tier_loop.rs) and Agent::run_inline_tool_loop (scheduler_loop.rs, the scheduler RunInline path — found missing by adversarial review of the first pass). Wired .with_tools_enabled(config.tools.enabled) at every Agent construction site across the workspace.
• Fixed a stale doc comment: LlmConfig::effective_embedding_model() claimed the global embedding-model fallback default is "nomic-embed-text", but default_embedding_model() actually returns "qwen3-embedding" — corrected the doc comment and an identical stale claim in crates/zeph-llm/README.md.

Closes #6386
Closes #6385

Testing

• Full CI-matching check suite (fmt, clippy --profile ci, nextest, rustdoc gate) green after rebase onto latest main: 14160/14160 tests passed.
• Added 5 regression tests exercising the real production entry points (Agent::process_response() and Agent::run_inline_tool_loop(), not internal helpers) plus a MockProvider::with_tool_recording() test-infra addition to assert on the tools argument sent to the provider.
• Live LLM round-trip verification (LLM Serialization Gate, per branching.md) against local Ollama, two scenarios:
  • [tools] enabled = true (baseline): real request payload carries 24 tool definitions; model attempts a tool call.
  • [tools] enabled = false: real request payload carries an empty tool list; model responds it has no directory-listing capability — confirming no tool defs reached the LLM. No 400/422 in either run.
• New playbook .local/testing/playbooks/tools-enabled-gate.md (5 scenarios covering CLI, TUI, serve-sessions/ACP, and the scheduler RunInline path) and a new coverage-status.md row.

Adversarial review notes

An implementation-critique pass on the first draft found the run_inline_tool_loop scheduler path was left ungated (scheduled/cron tool calls would have bypassed the new flag entirely). Fixed in this PR and re-verified by a delta-review before code review.