feat(cache): separate read/write LLM response cache controls

[jordanauge]

• spec.execution.cache.read and .write toggle cache lookups and cache
  writes independently, replacing the single use_cache on/off switch
• Configurable three ways: the manifest field above, MAS_LLM_CACHE_READ/
  MAS_LLM_CACHE_WRITE env vars, or --cache-read/--no-cache-read and
  --cache-write/--no-cache-write on mas-ctl chat
• Precedence, most to least specific: CLI flag -> spec.execution.cache.
  enabled (a hard kill-switch for both) -> cache.read/cache.write ->
  env vars -> default true for both
• A cached response that included tool_calls is now reconstructed and
  replayed correctly, not just cached plain text
• spec.execution.cache.read/write now actually pass manifest schema
  validation (previously only "enabled" was accepted, so this control
  surface was unreachable through a validated manifest)
• The LLM response cache's default file path now shares the same XDG
  convention as the trace/artifacts caches ($XDG_CACHE_HOME/mas/...),
  via the shared mas.runtime.xdg module instead of a separate ad hoc
  path resolution
• New docs/manifests/execution.md documents spec.execution in full
  (mocking, cache, parallel), linked from docs/manifests/README.md,
  agent.md, and user-config.md's cache path reference; Tutorial 3's
  experiments doc cross-links it to distinguish the LLM response cache
  from the unrelated per-run trace cache