feat(tools): planner 默认绑定 list_assets

新库经 PlannerTools() 并入 list_assets 绑定；老库由
seedPlannerListAssetsBinding() 一次性回填(flag 幂等，不覆盖用户解绑)。
planner 现同时具备 list_assets(DSL 全库检索)与 list_untested_assets(范围内未测)。

server/orchestration.go

@@ -448,6 +448,7 @@ func (s *Server) seedOrchestrationTools() {
 	s.refreshBuiltinToolSchemas()
 	s.seedAutoDefaultBindings()
 	s.seedPlannerDefaultBindings()
+	s.seedPlannerListAssetsBinding()
 	s.seedCompanyScopeRebind()
 	s.seedAutoReportFindingBinding()
 	s.unbindGoalMetDefault()
@@ -719,6 +720,23 @@ func (s *Server) seedPlannerDefaultBindings() {
 	_ = s.m.pg.SetSetting(flag, "true")
 }
 
+// seedPlannerListAssetsBinding adds "planner" to list_assets's binding ONCE
+// (guarded by a settings flag), so existing DBs — whose list_assets row was seeded
+// as auto/pentest-only — also let the planner query the asset store by DSL. Fresh
+// DBs already get it via PlannerTools(); this only backfills without overriding a
+// user unbind.
+func (s *Server) seedPlannerListAssetsBinding() {
+	const flag = "planner_list_assets_v1"
+	if v, _, _ := s.m.pg.GetSetting(flag); v == "true" {
+		return
+	}
+	if err := s.m.pg.AddAgentToToolBinding("planner", []string{"list_assets"}); err != nil {
+		log.Printf("[planner] list_assets 默认绑定失败: %v", err)
+		return
+	}
+	_ = s.m.pg.SetSetting(flag, "true")
+}
+
 // seedCompanyScopeRebind changes add_company_scope's default binding ONCE on
 // existing DBs (guarded by a settings flag): the tool moves off worker and onto
 // planner — defining a company's asset scope is a planning/main/auto concern, not