fix(core): MCP tool schemas with missing type:'object' cause provider rejection

## Problem

MCP servers can advertise tool input schemas with missing `type`, non-object `type`, or completely malformed structures. While the Gemini API is lenient with these, any provider that validates JSON Schema strictly (Vertex AI in strict mode, future multi-provider support, or tools that forward schemas to downstream APIs) will reject the request with errors like:

```
tools.N.custom.input_schema.type: Input should be 'object'
```

This affects MCP tools from third-party servers (Zapier, Linear, custom MCP servers) that don't always conform to the JSON Schema requirement of `type: 'object'` at the root level.

## Current Behavior

`DiscoveredMCPTool` passes the raw `parameterSchema` from MCP discovery directly through to the API. If the schema is `undefined`, `null`, missing `type`, or has `type: 'string'` at root, it reaches the API verbatim.

Similarly, `DiscoveredTool` in `tool-registry.ts` (for extension-discovered tools) passes raw `parametersJsonSchema` without normalization.

## Proposed Fix

Add a `normalizeToolSchema()` function that ensures every tool parameter schema has `type: 'object'` at root:

- Wraps `undefined`/`null`/primitive/array schemas with `{type: 'object', properties: {}}`
- Injects `type: 'object'` when the schema is an object but missing the `type` field
- Preserves valid schemas unchanged

Applied at two layers for defense-in-depth:
1. `DiscoveredMCPTool` constructor in `mcp-tool.ts`
2. `DiscoveredTool` registration in `tool-registry.ts`

I have a PR ready for this.