Make LangChain the default harness, with the tool loop governed (#33)

`agent-bot` hand-writes the AG-UI protocol and leaves the tool loop to
whatever is watching. That is a fine reference and a bad thing to build
a deployment on, so the default teammate endpoint is now
`agent-langgraph` on 4201: a real framework, running a real loop.

The loop moves into the agent, and stays governed. A framework Bot that
called an MCP server directly would be a Bot that walked around the
grant, the policy and the audit row, which are the product. So it calls
back to `/api/agent-tools/call`, authenticated by a shared secret
because the caller is a service with no person behind it, and that
route goes through the same plugin store as everything else. No secret
configured means the route does not exist and the Bot is told so, rather
than a deployment quietly accepting anybody who can reach the port.

The runtime now sends a remote agent the tools its Bot was granted, on
every run rather than configured once, so a grant added or revoked
applies to the next run and not after a restart.

Two defects fixed on the way. `BOT_MODEL` arrived from compose as an
empty string, which is a value, so the agent asked its provider for a
model named "" and every run died with "you must provide a model
parameter" — read as a broken Bot rather than missing configuration.
And the run emitted its answer before the tool calls that informed it,
so the surface drew a Bot that spoke first and worked afterwards; tool
events are now sent as they happen, with each stretch of prose owning
its own message id.

Driven in a browser: the LangGraph Bot answered a question about the
expense policy, the transcript drew the tool line and then the answer
with its source link, and the audit row names risk-analyst calling
through the deployment rather than the vendor.