feat(scripted-tool): add --dry-run flag with pluggable validation

[chaliy]

Summary

• Add --dry-run flag that validates arguments without executing the callback
• Add tool_with_dry_run() builder method for custom dry-run handlers
• Add --help flag interception (same output as help <tool>)

Details

When --dry-run is passed, the tool:

1. Strips --dry-run from args before parsing
2. Validates args against the schema
3. Returns structured JSON result without calling the callback:
   • Valid: {"dry_run":true,"valid":true,"tool":"name","params":{...}}
   • Invalid: {"dry_run":true,"valid":false,"tool":"name","error":"..."}

Custom dry-run handlers can be registered per-tool via tool_with_dry_run() for domain-specific validation (e.g. checking if a resource exists before mutating it).

--help takes precedence over --dry-run when both are present.

Test plan

• test_dry_run_validates_args — validates args and returns structured JSON
• test_dry_run_does_not_invoke_callback — fail_tool --dry-run succeeds
• test_dry_run_help_precedence — --help takes precedence
• test_custom_dry_run_handler — custom handler is called
• test_help_flag_returns_help — --help returns help text
• All 2459 lib tests pass

Closes #1279