feat(scripted_tool): add ScriptingToolSet with discovery mode support (everruns#534)

## Summary
- Adds `ScriptingToolSet`, a higher-level wrapper around `ScriptedTool`
that controls `system_prompt()` generation based on `DiscoveryMode`
- **Exclusive mode** (default): full tool schemas in prompt — best when
this is the only tool the LLM has
- **WithDiscovery mode**: semantic descriptions only, LLM uses
`discover` and `help` builtins — best for large tool sets or alongside
other tools
- Fixes pre-existing clippy warning in `mcp.rs` (unused `mut`)

## What
- New `ScriptingToolSet` struct implementing the `Tool` trait,
delegating execution to inner `ScriptedTool`
- `ScriptingToolSetBuilder` with fluent API: `.tool()`, `.env()`,
`.limits()`, `.short_description()`, `.with_discovery()`
- `DiscoveryMode` enum (`Exclusive` | `WithDiscovery`)
- Updated spec 014 with ScriptingToolSet documentation and module layout

## Why
When `ScriptedTool` is used alongside other discovery-capable tools,
full schemas in the system prompt waste tokens. `ScriptingToolSet` lets
the caller choose: full schemas upfront (exclusive) or semantic-only
with discover/help builtins (discovery mode).

## Test plan
- [x] 17 unit tests covering both modes, prompt content, execution
delegation, status callbacks, builtins, env vars, schemas
- [x] `cargo fmt --check` passes
- [x] `cargo clippy --all-targets -- -D warnings` passes
- [x] `cargo test --all-features` passes (all 1575 tests)
- [x] Feature-gated build with and without `scripted_tool` feature

Author: chaliy

crates/bashkit/src/lib.rs

@@ -397,7 +397,10 @@ pub use network::NetworkAllowlist;
 pub use tool::{BashTool, BashToolBuilder, Tool, ToolRequest, ToolResponse, ToolStatus, VERSION};
 
 #[cfg(feature = "scripted_tool")]
-pub use scripted_tool::{ScriptedTool, ScriptedToolBuilder, ToolArgs, ToolCallback, ToolDef};
+pub use scripted_tool::{
+    DiscoveryMode, ScriptedTool, ScriptedToolBuilder, ScriptingToolSet, ScriptingToolSetBuilder,
+    ToolArgs, ToolCallback, ToolDef,
+};
 
 #[cfg(feature = "http_client")]
 pub use network::HttpClient;

crates/bashkit/src/scripted_tool/mod.rs

@@ -117,6 +117,9 @@
 //! the same `Arc<ToolCallback>` instances are reused across `execute()` calls.
 
 mod execute;
+mod toolset;
+
+pub use toolset::{DiscoveryMode, ScriptingToolSet, ScriptingToolSetBuilder};
 
 use crate::ExecutionLimits;
 use std::sync::Arc;