feat(eve): add declarative framework tool allowlists

[bob-obringer]

Description

Closes #1309.

eve currently enables every framework-provided tool unless the author creates filesystem disable sentinels one by one. That is fragile for capability-sensitive agents because a newly added built-in becomes available after an upgrade without an explicit application decision.

This adds an optional builtInTools allowlist to defineAgent(). Omitting it preserves the existing behavior. Enabling it denies unlisted framework tools while leaving authored tools and same-name authored overrides alone. The policy survives compilation, is enforced for static tools, connection_search, and queued recursive agent actions, and is reported by /eve/v1/info. Unknown names fail with an authoring error instead of silently weakening the policy.

How did you test your changes?

• pnpm fmt
• pnpm lint
• pnpm check:deps
• pnpm guard:invariants
• pnpm docs:check
• pnpm typecheck
• pnpm test:unit — 5,563 passed, 1 skipped
• pnpm test:integration — 566 passed, 1 skipped
• pnpm build
• pnpm test:scenario — 370 passed, 15 skipped; two unrelated framework-next-build cases stop during the fixture's pnpm install because local pnpm rejects ignored esbuild and sharp build scripts before exercising this change

PR Checklist

• I linked an issue with prior discussion confirming this change is wanted
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

[vercel]

@bob-obringer is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

[bob-obringer]

Closing this draft so Bob can review the implementation locally before any upstream publication. No merge requested.