fix(ai): admit bounded native tool catalogues above 64 definitions

[first-assist]

Summary

Native session creation rejects a reviewed host catalogue above 64 exact bootstrap fingerprints before any model turn starts. A host with 84 registered profile tools and two built-ins therefore cannot begin an investigation. Raise the finite session-binding bound to 128 and align the Grok SDK's separate exact-definition bound with Codex's existing 128-definition ceiling.

All tools remain advertised. Exact fingerprint binding, duplicate/schema checks, current authority, callback limits and provider frame/byte limits remain enforced. The complete provider surface, including broker definitions, must fit its own ceiling. Only graphql-orm-ai advances to 0.106.1; no ORM/macro source, persistence format, GraphQL SDL or schema-module changes.

Verification

• Baseline regression reproduced rejection at 65 fingerprints; corrected boundaries admit 64, 65, 86 and 128 and reject 129.
• 739 scoped AI/provider tests passed (46 existing ignores), including Grok's 65/90/128 admission and 129 rejection; PascalCase naming test passed.
• Explicit-package SemVer against the reviewed baseline passed (196 checks); unchanged durable fingerprint/SDL contracts reviewed.
• Warnings-denied scoped Clippy and warnings/missing-docs-denied Rustdoc passed.
• Format, documentation, package release policy, inventory, workspace dependency boundaries, release state and deterministic manifest checks passed.
• Every compiling command ran in the shared host's bounded Cargo cgroup; tests use synthetic/in-memory fixtures. Full hosted release validation remains the final human-approved release gate.

Documentation impact

• Documentation updated
• No documentation impact

Explanation: README, changelog, migration guidance and capability documentation describe the finite limits, complete-surface accounting and unchanged authority/persistence contracts; generated package inventory records 0.106.1.

[Dastari]

Release coordination requested by the owner: the running workspace-2026.10.01.2 release at 37e45fb contains the AI-capacity fix but excludes ORM PRs #96/#98/#99 and PR A #97. Please keep .2 assigned to that tested source; I am reconciling and merging the independent cross-crate, authorization and text-group fixes, plus investigating the globally installed RowPolicy projection blocker. Remaining GEMA requirements stay open in #91, and A/B–D review gates stay separate. Before I allocate another immutable workspace identity, please confirm .2 remains yours and identify the next available identity for the subsequent compatible ORM release. No existing tags will move and no router binary distribution is requested.