[FIX] Enable tool_arg_contract by default for native tools with safe schemas (#1487 child C)

[Lexus2016]

Parent: #1487

Depends on: #1528 (audit), #1529 (type checking)

Task

After the audit (#1528) identifies which tools have safe schemas and the type-check extension (#1529) is in place, enable the tool_arg_contract check by default for native tools whose schemas are confirmed safe (i.e., have required declarations and won't break common agent behavior).

Approach

1. Change tool_arg_contract_enabled() default from OFF to ON, but add a per-tool exclusion list for tools whose schemas are incomplete or that would break (identified by [FIX] Audit native tool schemas for contract-check compatibility (#1487 child A) #1528)
2. Alternatively: add a tool_arg_contract.excluded_tools config key listing tools to skip
3. Add a migration note: if any tool breaks, users can disable via config or add to exclusion list
4. Update the test suite to verify the check fires by default for safe tools

Constraints

• Must fit 200-line self-merge cap (config plumbing + default flip + exclusion list + tests)
• Must be revertible via config (no hard-coded ON without escape hatch)
• The REALIZED_RATE_LOW consolidation mode means this should be conservative: only enable for tools where the audit confirms zero risk of breakage

Effort

~0.4 (Easy-Medium, < 4 hours): config plumbing + default change + tests

[Lexus2016]

Implementation PR: #1533. Flips tool_arg_contract default to ON + adds per-tool exclusion list (excluded_tools config). All 93 tests green.

[Lexus2016]

Implementation sent to PR #1534: flips tool_arg_contract default ON for native tools with safe schemas (the #1528 audit set). Within the 200-line self-merge cap (165 lines). All gate + integration + dispatch-adjacent tests green locally.