Add ToolSelector for enabling sandboxed python per agent, drop unsafe
filesystem/bash tools, bundle fetchUrl with web search, and return
Monty's last expression value so agents need not print.
Adds a config jsonb column to agents for per-agent search settings
(enabled, rerank, maxResults). Types systemAssistants with rename and
rerank sub-objects. Backfills missing systemAssistants keys on settings
fetch. Includes generated drizzle migrations.