perf(mcp-dispatch): avoid redundant tool-call and argument clones

[leseb]

Summary

Remove redundant deep copies while identifying and executing MCP tool calls in the Responses MCP dispatch filter.

The response decision path only inspects calls, while the execution path eventually needs owned arguments. Each path should copy data only at the ownership boundary that actually requires it.

Scope

• Let the response decision path inspect matching MCP calls by reference or index instead of collecting cloned JSON values.
• Thread tool-call argument ownership through parse_call_arguments and normalize_arguments so object-valued arguments are not cloned once to extract them and again to normalize them.
• Preserve the original raw string needed for malformed-argument errors without introducing a replacement deep copy.

Acceptance criteria

• Read-only dispatch and approval checks do not clone complete MCP tool-call values.
• Object-valued execution arguments incur no redundant deep clone before constructing the MCP request.
• String-valued arguments retain their canonical representation and are not double encoded.
• Malformed, missing, and non-object argument behavior and error bodies remain unchanged.
• Approval decisions, execution ordering, parallel execution, and result accumulation remain unchanged.
• Focused MCP dispatch, approval, and argument-representation tests pass.

Non-goals

• Redesigning ownership of the full MCP tool map.
• Adding a reverse encoded-name index without separate benchmark evidence.

Parent

• perf(apis): remove confirmed redundant allocations #898