fix(coding-agent): use tool-name allowlists and remove cwd-bound singletons

- treat tools as a global allowlist across built-in, extension, and SDK tools
- remove process-cwd singleton tool usage from SDK and CLI paths
- add regression coverage for extension tool filtering

closes #3452
closes #2835

packages/coding-agent/test/agent-session-runtime-events.test.ts

@@ -76,7 +76,6 @@ describe("AgentSessionRuntime session lifecycle events", () => {
 		cleanups.push(async () => {
 			await runtimeHost.dispose();
 			faux.unregister();
-			process.chdir(tmpdir());
 			if (existsSync(tempDir)) {
 				rmSync(tempDir, { recursive: true, force: true });
 			}