[FEATURE] Offer only authorized tools to `opensre ask`

Problem statement

opensre ask currently advertises approval-gated tools such as shell_run to the action model, then rejects a selected tool at execution time unless the caller passed --allowed-tool. For ambiguous requests such as opensre ask "what is this?", this can produce an approval-denied result even though the agent could have answered without local shell access.

The policy is safe, but the selection experience is confusing and an unnecessary dead end.

Proposed solution

Make the model-visible tool catalog match the authority granted for the invocation:

• With no authorization flags, expose only tools that do not require approval.
• With --allowed-tool NAME, expose that approved gated tool as well as the non-gated tools.
• With --dangerously-bypass-approvals, expose all registered tools.
• Retain the existing execution-time approval hook as a fail-closed backstop.

Add clear model guidance to answer general questions directly where possible and use an available tool only when evidence is needed. This remains model-directed: do not add keyword/regex intent routing and do not auto-approve shell commands that look read-only.

Acceptance criteria

• A default ask invocation does not include shell_run or another approval-gated tool in its model tool schema.
• An explicitly allowed gated tool is included in the schema for that invocation.
• Non-gated read-only tools remain available by default.
• The execution-time approval hook still blocks an unauthorized call if one reaches it.
• Tests cover default, explicitly allowed, and bypassed tool catalogs.

Related: #6195 and #6196.