fix(tools): honor agent tool denylist without sandbox

src/config/types.ts

@@ -816,6 +816,11 @@ export type ClawdbotConfig = {
         maxAgeDays?: number;
       };
     };
+    /** Global tool allow/deny policy for all providers (deny wins). */
+    tools?: {
+      allow?: string[];
+      deny?: string[];
+    };
   };
   routing?: RoutingConfig;
   messages?: MessagesConfig;

src/config/zod-schema.ts

@@ -370,6 +370,12 @@ export const ClawdbotSchema = z.object({
       modelFallbacks: z.array(z.string()).optional(),
       imageModelFallbacks: z.array(z.string()).optional(),
       contextTokens: z.number().int().positive().optional(),
+      tools: z
+        .object({
+          allow: z.array(z.string()).optional(),
+          deny: z.array(z.string()).optional(),
+        })
+        .optional(),
       thinkingDefault: z
         .union([
           z.literal("off"),