fix!: dispatch only tools the tools list declares

[Martin Bens (SpiGAndromeda)]

Closes #29.

Problem

handle_tools_call decided that a tool existed by checking for a shell function tool_<name> with type. validate_tool_arguments returned success for a name with no tools-list entry. A sourced function the server never declared was therefore dispatched with its arguments unchecked. Every tool_<name>_cancel hook also answered as tool <name>_cancel. type also matches executables, so a tool_x on PATH ran as a tool or as a cancel hook.

Behavior

The tools list decides which tools exist. handle_tools_call checks in this order:

1. params object gate → -32602 (unchanged)
2. name pattern → -32602 Invalid tool name (unchanged)
3. _mcp_tool_schema reads the tools list once:
   • undeclared name → -32601 Tool not found: <name>
   • unreadable list, duplicate entry, or absent/null inputSchema → isError result
4. declare -F tool_<name> → -32601 when no function exists
5. _mcp_validate_against_schema checks the arguments against the schema from step 3 → isError on violation
6. dispatch

The lookup uses the same .tools[]? iteration as before, so the declaration check and the validation read the list the same way. _run_cancel_hook also resolves hooks with declare -F. A tool function can still call another tool_* function directly in shell. A nested handle_tools_call follows the declaration rule.

Compatibility

• An undeclared tool_<name> function, including a cancel hook called as a tool, answers -32601 instead of running.
• A declared entry with no or a null inputSchema answers isError instead of dispatching unvalidated. README previously documented the unvalidated dispatch.
• validate_tool_arguments keeps its signature and returns 1 for an undeclared name, where it returned 0.
• A name declared twice now answers with its own message instead of they could not be evaluated against its schema.

AGENTS.md §Compatibility contract classifies tightening the validator as major. The [Unreleased] CHANGELOG entry carries no version marker, so the bump is decided at release. Consumers should declare every tool their clients call in tools.json with an inputSchema before bumping the pin.