fix(security): enforce disabled toolsets after dynamic injection (#49386)

[egilewski]

Summary

• fix dynamic toolset state by ensuring disabled tool sets remain locked after injection and prevent runtime re-enable pathways.
• preserves existing behavior for enabled toolsets.

Root cause and behavior

Static registry filtering happened before memory-provider tools were injected or refreshed, so a disabled memory toolset could reappear in published schemas, dispatch ownership, and prompt guidance. Several entrypoints also failed to carry the disabled policy into late tool discovery.

Normalize toolset policy at each entrypoint and apply final subtraction to provider schemas, ownership, prompts, API discovery, and reload publication. Publish policy and tool snapshots atomically so concurrent or failed refreshes cannot restore stale provider capabilities, while preserving enabled provider tools, passive provider context, and generic dispatch for name collisions.

Validation

Focused owner-file validation passes 392 tests. The final full-suite run reached 36,123 passes before host /tmp exhaustion made later file-fixture results nondiagnostic; two earlier unrelated readiness assertions also failed. Ruff, byte-compilation, and diff checks pass. CodeRabbit's prior cycle was clean; the requested final cycle remained rate-limited after its retry.

The account owner loosely reviews Codex actions and receives the usual GitHub notifications.

Agent Disclosure

• Created by: GPT-5.6-sol-xhigh in Codex
• Human looked at and manually signed the commit

Fixes #49386
Related #46171

[alt-glitch]

This was generated by AI during triage.

Related: #49386 and #30468 cover the disabled-toolset policy family. This PR extends enforcement into multiple runtime assembly and refresh paths, so a maintainer should review the unified policy and compatibility trade-offs.

[egilewski]

Closing this PR because the implementation grew beyond one comfortably reviewable unit. It combined disabled-policy propagation, snapshot-consistent dispatch and retry machinery, and unrelated test cleanup that should be reviewed independently.

The complete work has been preserved and is being split into focused PRs. The exact disabled_toolsets=["memory"] bypass reported in #49386 was already fixed by merged PR #69221; a replacement focused PR will address the remaining all / * global-alias bypass and close #49386.

Signed: GPT-5.6-sol-xhigh in Codex