fix(mcp): resolve toolsets from live registry

[teknium1]

Summary

Salvage of PR #9849 by @g-guthrie — cherry-picked onto current main.

Removes the dual-source-of-truth problem where MCP toolset state lived in both the tool registry and runtime-mutated toolsets.TOOLSETS. Replaces _sync_mcp_toolsets() with a registry alias system — the registry is now the single authority for MCP tool membership.

Changes

• tools/registry.py — New _toolset_aliases dict with register_toolset_alias() / get_toolset_alias_target(). Auto-cleans aliases when deregister() removes the last tool in a toolset.
• tools/mcp_tool.py — _sync_mcp_toolsets() deleted. _register_server_tools() uses registry.register_toolset_alias() instead of create_custom_toolset() + hermes-* injection. shutdown() now properly deregisters tools.
• toolsets.py — get_toolset() falls through to registry for names not in TOOLSETS. validate_toolset() checks registry aliases. resolve_toolset() returns sorted() for determinism.
• Tests fully updated for new resolution path.

Follow-up (ours)

• Updated stale comment in cli.py that still referenced _sync_mcp_toolsets.

Validation

238 passed — tests/test_toolsets.py tests/tools/test_mcp_dynamic_discovery.py tests/tools/test_mcp_tool.py tests/test_model_tools.py tests/hermes_cli/test_tools_config.py
3026 passed — tests/tools/ + tests/test_toolsets.py + tests/test_model_tools.py (1 pre-existing unrelated failure)

Closes #9849