feat: per-agent tools toggle and better python scratchpad

Add ToolSelector for enabling sandboxed python per agent, drop unsafe
filesystem/bash tools, bundle fetchUrl with web search, and return
Monty's last expression value so agents need not print.

drizzle/schema.ts

@@ -112,7 +112,10 @@ export const agents = pgTable('agents', {
             enabled: boolean;
             rerank: boolean;
             maxResults: number;
-        }
+        };
+        tools?: {
+            python?: boolean;
+        };
     }>().default({}),
     createdAt: timestamptz('created_at').notNull().defaultNow(),
 }, (table) => [