Structural validation for provider-emitted tool calls.

Provider output is untrusted. Validate the complete batch before persisting an event, invoking callbacks, or starting any tool so a malformed later entry cannot leave an invocation partially executed.