fix(agents): keep the task tool hidden under ambient wildcard denies — re-emit the wildcard after named hidden-agent denies (deterministic map order), preserving named-deny enforcement for non-fleet configs

Co-Authored-By: Alfonso <alfonso@cortexkit.io>