Requires-tools preflight for worker dispatch

[TheGreatAxios]

Verifies a worker's hard tool requirements pre-spawn and fails closed with a reroute hint.

• spawn_agent accepts requires_tools (canonical names); the dispatcher runs a capability preflight against the worker's capability mount before any session, telemetry, or worktree exists. Rejections return a reroute hint naming a capable director/profile.
• run.ts re-checks stamped requires_tools against the mounted tools at run start; a tool missing in between fails as stale_snapshot (setup_error, non-continuable).
• Session records stamp requiresTools + snapshotRevision; profiles.ts exposes load diagnostics (revision + malformed files) additive over loadAgentProfiles.
• wait_agents documents preflight rejections and stale_snapshot failures as failed without the continuable marker.

Reroute hint: a preflight rejection names the missing tool and a capable reroute target — re-dispatch deliberately against that target, never auto-retry or spawn a speculative successor.
Non-continuable semantics: preflight rejections and mount-time stale_snapshot failures are terminal setup failures, not transient provider errors; they carry no continuable marker and must not be re-waited, retried, or continued.

Fixes CL-9476

[linear-code]

CL-9476