v0.1.21

Fixed

When prompt injection manipulates the model into emitting internal markup (GPT-OSS <|channel|> tokens etc.), _normalise_content() strips the response to empty — but the user's original task ("show me the file contents") was silently lost, showing only 完了.

Now the executor records each tool's raw output during execution. If the final LLM summary is empty after normalisation, the raw tool outputs are returned directly so the user still receives the actual data the tool produced.