runtime: carry synthesis-only tool transitions

[raphael]

Summary

• add a durable planner-step contract for tool batches that must be followed by answer synthesis
• carry the transition through the Temporal planner activity input
• enforce synthesis-only planner output at the activity boundary
• reject combinations with bookkeeping-only or terminal-tool batches

Rationale

A planner may know when its selected tool batch will provide all evidence needed
for the final answer. Previously, applications had to preserve that decision in
process-local state or infer it again from tool results. That is not correct in
a distributed Temporal runtime because the resume activity may execute on a
different worker.

PlanResult.SynthesizeAfterTools now records the decision on the selected
workflow step. The workflow carries it as PlanActivityInput.SynthesisOnly and
exposes it to PlanResume. The resume activity rejects additional tool calls or
nonterminal output, making the contract deterministic rather than advisory.

This is orthogonal to existing tool metadata:

• Bookkeeping continues to own tool budget and failure-streak exemptions.
• TerminalRun continues to end the run from the tool result without another
  planner turn.
• tool-call caps, failure caps, deadlines, authorization, and retry metadata
  continue to run before normal planner resume.

Synthesis-after-tools therefore requires at least one budgeted tool and rejects
terminal tools, ensuring the existing step classifier will produce the required
resume.

Validation

• make lint
• go test ./runtime/agent/runtime ./runtime/agent/planner ./runtime/agent/api
• go test -race ./runtime/agent/engine/temporal -run TestSealRegistrationCanRetryAfterActivationTimeout -count=1
• make test completed all affected packages; one unrelated timing-sensitive
  Temporal worker activation test failed in the full parallel suite and passed
  when rerun alone under -race