Agent: forward ingress clientTools to embedded runs

Pass ingress-supplied `clientTools` into embedded runner executions so the
embedded path sees the same tool definitions and preflight validation as direct
gateway requests.

Add a focused regression test covering the embedded-run path that previously
dropped the ingress tool configuration.

src/agents/pi-embedded-runner/run.ts

@@ -888,6 +888,7 @@ export async function runEmbeddedPiAgent(
             prompt,
             images: params.images,
             disableTools: params.disableTools,
+            clientTools: params.clientTools,
             onPreflightPassed: params.onPreflightPassed,
             provider,
             modelId,

src/commands/agent.test.ts

@@ -420,11 +420,22 @@ describe("agentCommand", () => {
       const store = path.join(home, "sessions.json");
       mockConfig(home, store);
       const onPreflightPassed = vi.fn();
+      const clientTools = [
+        {
+          type: "function",
+          function: {
+            name: "web_search",
+            description: "test client tool",
+            parameters: { type: "object", additionalProperties: false, properties: {} },
+          },
+        },
+      ];
       await agentCommandFromIngress(
-        { message: "hi", to: "+1555", senderIsOwner: false, onPreflightPassed },
+        { message: "hi", to: "+1555", senderIsOwner: false, clientTools, onPreflightPassed },
         runtime,
       );
       const ingressCall = vi.mocked(runEmbeddedPiAgent).mock.calls.at(-1)?.[0];
+      expect(ingressCall?.clientTools).toBe(clientTools);
       expect(ingressCall?.onPreflightPassed).toBe(onPreflightPassed);
     });
   });