feat(dynamic-tools-cache): 4 cache tools + global __padded API

Implements the openclaw side of Plexum decision #37: agent-driven
per-session whitelist of which tools the model sees. Cross-runtime
aligned with Plexum's host implementation (same tool names, same
input schemas, takes-effect-next-turn).

New surface:
  - tools/dynamic-tools-cache.ts:
      Catalog (in-memory map), Cache file (atomic tmp+rename at
      <openclaw>/agents/<id>/sessions/<sid>/dynamic-tools-cache.json),
      4 tool factories (list/search/cache/evict), allowTool gate,
      installGlobalApi for globalThis.__padded with buffer-drain
  - index.ts: install __padded early; register the 4 cache tools
    as factories wrapping ctx into execute
  - openclaw.plugin.json contracts.tools += 4 names

Other Hangman-Lab plugins (Fabric / HF / Dialectic) opt in to the
gate by wrapping their registerTool calls (separate commits in those
repos). Built-in openclaw tools and non-opt-in plugins remain
always-on.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

plugin/openclaw.plugin.json

@@ -10,7 +10,11 @@
       "pcexec",
       "proxy-pcexec",
       "safe_restart",
-      "dynamic-trim"
+      "dynamic-trim",
+      "dynamic-list-tools",
+      "dynamic-search-tools",
+      "dynamic-cache-tools",
+      "dynamic-evict-tools"
     ]
   },
   "configSchema": {