bug(runtime): Full access sessions still advertise Bash boundary parameters and the RequestSandboxBoundary tool

## Environment

- Maka commit `58465213`, CLI `0.2.0`
- macOS 26.6.1 (arm64)
- Node.js 24.19.0
- TUI entry point: `packages/cli/dist/dev-cli.js`
- Connection: Custom relay (OpenAI Chat-compatible), captured between Maka and the relay

## Summary

After switching a production TUI session to Full access, the Runtime ledger correctly records a `bypass` sandbox boundary, but the composed model tool surface continues to describe a boundary that the host will not enforce. Bash still advertises `boundary_intent` and `required_boundary`, and the composition layer still includes the `request_sandbox_boundary` capability.

`buildManagedBashTool` already supports `declareSandboxBoundary: false` and explicitly documents that parameters no host enforces are pure noise. `buildBuiltinTools` does not expose or forward that option, while `interactive-run-composer.ts` has the session permission mode but does not use it when projecting the built-in tool surface.

## Evidence

- In the original Full access capture, **87/87 provider requests** still carried both `boundary_intent` and `required_boundary` in the Bash schema even though `sandbox_boundary_log` recorded `{"kind":"bypass"}`.
- The provider-visible Bash description still ended with `Enforced by the current session sandbox boundary.`
- A direct factory comparison produced six fields through `buildBuiltinTools({ shellRuns })`:
`command`, `timeout_ms`, `run_in_background`, `pty`, `boundary_intent`, `required_boundary`.
- The same managed Bash factory with `declareSandboxBoundary: false` produced only four fields:
`command`, `timeout_ms`, `run_in_background`, `pty`.

This is the provider-visible reproduction requested when item 8 of #4267 withdrew the earlier schema-boilerplate change.

## Why it matters

The optional nested boundary schema is also the point where we saw OpenAI models on a Chat-compatible relay degenerate into whitespace-only tool-argument streams (#4861). Full access should be the clean way around that schema, but today it keeps sending it.

Even without that provider behavior, advertising ignored boundary arguments and an inapplicable expansion tool gives the model a false description of the active execution contract.

## Expected behavior

- Full access (`permissionMode: bypass`) advertises Bash without `boundary_intent` or `required_boundary` and without the boundary-enforcement description suffix.
- Full access composition omits `request_sandbox_boundary` because a bypass boundary has nothing to expand.
- Auto modes (`ask` and `explore`) keep the existing six-field Bash schema and the boundary-request capability.
- Switching back from Full access restores the Auto tool surface on the next composed run.

## Scope note

This issue is only about projecting the model-visible tool surface from the permission mode already available during run composition. It does not change sandbox execution, boundary persistence, or the Auto-to-Bypass refresh behavior tracked in #3349.