~do not load tools by IDs, load tools by URLs

this ticket's title is perhaps overly specific in the solution

the problem is that we load tools by a string that could be declared by any package. there are many, many, many ways we could solve this. we should do one of them

The issue names no files, tests, or entry points. First trace where tools are loaded from package-declared strings and review how tool identity is resolved. Done means choosing and documenting a loading approach that avoids collisions between packages, with tests covering the resulting behavior.

Written by the indexing model from the issue text.