refactor: move the email alias rule into tool_security; extract the assistant seed constant

Code-quality pass over the PR's own changes:

- The bare<->qualified email aliasing rule lived inline in the generic
  dispatcher (_execute_tool_block_impl). It is policy knowledge, so it
  moves next to BUILTIN_EMAIL_TOOLS as email_tool_policy_names(); the
  dispatcher just consumes it, and the rule gets its own unit test
  (including the mcp__email__<not-a-tool> and mcp__other__ non-alias
  cases).

- The default Assistant's enabled_tools list was an inline literal
  inside the CrewMember seed, and its registry-sync test asserted a
  source-code substring. Extracted to DEFAULT_ASSISTANT_ENABLED_TOOLS
  so the test imports and checks the actual value.

- _fenced_tool_call return type tightened to Optional[Tuple[str, str]].

No behavior change; suite green (3295 passed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_email_registry_sync.py

@@ -116,7 +116,23 @@ def test_frontend_tool_selector_covers_email_tools():
 
 def test_default_assistant_seed_covers_email_tools():
     """The default Assistant crew seed grants the full email set."""
-    source = (_REPO_ROOT / "src" / "task_scheduler.py").read_text()
-    assert "*sorted(BUILTIN_EMAIL_TOOLS)" in source, (
-        "default assistant enabled_tools no longer derives from BUILTIN_EMAIL_TOOLS"
-    )
+    from src.task_scheduler import DEFAULT_ASSISTANT_ENABLED_TOOLS
+
+    assert BUILTIN_EMAIL_TOOLS <= set(DEFAULT_ASSISTANT_ENABLED_TOOLS)
+
+
+def test_email_policy_name_aliases():
+    """The alias rule every execution gate relies on."""
+    from src.tool_security import email_tool_policy_names
+
+    assert email_tool_policy_names("list_emails") == {
+        "list_emails", "mcp__email__list_emails",
+    }
+    assert email_tool_policy_names("mcp__email__delete_email") == {
+        "delete_email", "mcp__email__delete_email",
+    }
+    # Non-email names alias only to themselves — including mcp__email__
+    # spellings of tools the email server doesn't expose.
+    assert email_tool_policy_names("bash") == {"bash"}
+    assert email_tool_policy_names("mcp__email__not_a_tool") == {"mcp__email__not_a_tool"}
+    assert email_tool_policy_names("mcp__other__list_emails") == {"mcp__other__list_emails"}