v0.6.7 - Agentic Phase 1: tool runtime, structured calls, research tracing

• Agentic execution layer (ember::agent): model -> parsed structured tool call -> schema validation -> execution -> result reinjection into the same session -> continuation -> final answer, as an explicit state machine with hard limits (steps, tool calls, wall time, per-tool timeout, per-turn tokens, result bytes).
• Tool runtime: JSON-Schema-compatible schemas (string/number/integer/bool/array/object/enum), strict validation collecting every violation, frozen registry with duplicate rejection, watchdog timeouts, contained panics.
• Protocol boundary: Qwen2.5 <tool_call> and Llama 3.x <|python_tag|> codecs plus a generic-JSON testing mode; renders pinned byte-exactly; broken calls reject loudly instead of silently degrading to text. One call per step (documented).
• Research tracing: crash-tolerant JSONL (ember.agent.trace.v1, monotonic sequence, torn-line tolerant), privacy knobs with documented defaults, provenance events (version/git/rustc/target/model sha256/quant/tokenizer hash/tool-schema snapshot), hashed artifact records.
• Deterministic built-in tools: calculate, lookup, echo, write_artifact, fail, sandboxed read_text_file/search_text. No shell/network tools by design.
• CLI: ember agent run, ember agent demo, ember trace inspect.
• Validation: 40 lib unit tests + 19 hermetic scripted-model integration tests; real-GGUF gate executed against Llama-3.2-1B-Instruct-Q8_0 (llama3 protocol) and Qwen2.5-1.5B-Q8_0 (qwen25 protocol, 4-tool research workflow with correct arithmetic and a hashed artifact).
• Performance: orchestration overhead ~0.5-1.9 ms per mock run; tracing adds ~0.2 ms; ~16 events (~5 KB) per one-tool run.

All changes are additive: no attention/KV/tokenization/encoder/tensor code touched, zero unsafe added.