Wraps every tool call with: capability check, caching, redaction, journaling.

Tool modules are resolved in order:

1. Actor-registered tools (set via tools DSL in the actor module)
2. App-level capability registry (config :cyclium, :capability_registry), which may be a map (%{capability => ToolModule}) or a module implementing tool_for/1.