feat(config): add Zod validation for routing.agents sandbox and tools

Validate per-agent sandbox config:
- mode: 'off' | 'non-main' | 'all'
- scope: 'session' | 'agent' | 'shared'
- perSession: boolean
- workspaceRoot: string

Validate per-agent tools config:
- allow: string[]
- deny: string[]

src/config/zod-schema.ts

@@ -247,6 +247,12 @@ const RoutingSchema = z
                 workspaceRoot: z.string().optional(),
               })
               .optional(),
+            tools: z
+              .object({
+                allow: z.array(z.string()).optional(),
+                deny: z.array(z.string()).optional(),
+              })
+              .optional(),
           })
           .optional(),
       )