fix(code-execution): key remote kernels by tool set

[Liuzikaii]

Summary

• include the sorted sandbox tool set in persistent remote-kernel cache keys
• spawn a fresh kernel and regenerate hermes_tools.py when capabilities change
• preserve owner-based disposal while matching the local session-kernel key invariant
• add regression coverage for capability changes on the same owner/environment

Fixes #97263

Testing

• python -m pytest -p no:cacheprovider tests/tools/test_code_kernel_remote.py tests/tools/test_code_kernel.py -q
• python -m ruff check tools/code_kernel_remote.py tests/tools/test_code_kernel_remote.py

[Enough1122]

AI code review — automated review for reference; please use your judgment.

Overall: Keys remote kernels by tool set to avoid stale stubs.

What it does

• tools/code_kernel_remote.py:_kernel_key now return (owner,"remote",env_type,task_env_id,tuple(sorted(sandbox_tools))); execute_in_remote_kernel passes sandbox_tools through. Switching from {"read_file"} to {"web_search"} spawns second kernel (len(_REMOTE_KERNELS)==2, two nohup), each with fresh tool stubs instead of reusing prior kernel's read_file stub when web_search needed.

Non-blocking notes

• tuple(sorted(...)) makes key deterministic irrespective of input order — good.
• _REMOTE_KERNELS growth now bounded by tool-set permutations; still capped by existing idle_exit reaper and max_session_kernels eviction.

Correct isolation fix, same invariant as local (#94647).

Non-blocking — please use your judgment.

[kshitijk4poor]

Landed on main via #103668 as 7b8cf4c631, with your authorship preserved on the fix commit, @Liuzikaii — thank you. Closing in favour of the merged salvage.