/plan mode strips tool set to 4 tools, breaking /fleet and read-only workflows

## Describe the bug

When a session enters **plan mode** (`/plan` or `[[PLAN]]` prefix), the available tool set drops from ~47 tools to just **4**: `powershell`, `report_intent`, `skill`, `task`. A `tools_changed_notice` confirms the removal.

File reading still works via `powershell` and `task(explore)`, and the model can ask clarifying questions via plain text. But the following tools have **no workaround**:

- **`read_agent` / `list_agents`** — cannot retrieve results from background agents. `/fleet` launches agents via `task(mode: "background")` but their results are silently lost.
- **`sql`** — todo tracking and session store queries fail, despite the system prompt referencing SQL tables and todo status.

## Affected version

0.0.421-0

## Steps to reproduce the behavior

1. Start a Copilot CLI session
2. Have a normal conversation — process log shows `tool_count: 47`
3. Enter plan mode via `/plan `
4. The model receives a `tools_changed_notice` listing nearly all tools as "no longer available" — only `powershell`, `report_intent`, `skill`, `task` remain (process log: `tool_count: 4`)
5. Use `/fleet` to launch parallel work
6. Fleet dispatches background agents via `task(mode: "background")`
7. The model tries to call `read_agent` to retrieve results — tool does not exist
8. Background agent results that don't leave filesystem artifacts (e.g., investigation-only or API-call agents) are permanently lost

## Expected behavior

Plan mode should retain tools that have no workaround:

| Tool | Why it's needed | Workaround? |
|------|----------------|-------------|
| `read_agent`, `list_agents` | Retrieve background agent results | ❌ None |
| `sql` | Todo tracking, session store queries | ❌ None |
| `ask_user` | Clarifying questions during planning | ⚠️ Degraded — model falls back to plain text questions, but the system prompt explicitly says "use the ask_user tool to confirm assumptions," creating a mismatch between instructions and available tools |

## Additional context

- **OS:** Windows 11 (x86_64), Windows Terminal, PowerShell 7
- The model generates incorrect self-diagnoses about tool availability (e.g., "read_agent may never have been available") because it only sees the current restricted set.
- The system prompt still references SQL tables, todo tracking, and `ask_user` usage, but these tools are unavailable — causing silent failures or instruction-tool mismatches.
- **Related:** #1171 requests plan mode to block write tools — this issue is the inverse: read-only tools with no workaround are being blocked.