fix(agent): 探索图工具在无任务上下文时拒绝而非 nil 崩溃

buildDomainReg 构造的 server 级 ToolSet 恒持 nil ExplorationStore(taskID=0)，
tools 表可把其中任一工具绑给不在任务内运行的 agent(auto/pentest/reporter/
自定义/旁路提问)。node_detail 等探索图工具直接解引用 t.ts，被这类 agent 调用即
nil deref；panic 发生在 harness 自己的 goroutine 上，server 侧任何 recover 都
够不到，整进程退出，重启后调度器又拉起同一 agent 再崩，形成崩溃循环。

- 新增 readExpTool/writeExpTool + needExploration：t.ts==nil 时返回可读的工具
  错误(提示改用带 task_id 的跨任务读取工具)，把 17 个探索图工具切过去
- anchorOwner 补判空
- AugmentTools 出口给每个工具套 guardPanic：handler panic 降级成工具错误并打
  stack，覆盖域工具/SDK/MCP/skill，进程不再陪葬
- 注明 buildDomainReg 的 nil-store 契约

server/assembly.go

@@ -337,6 +337,12 @@ func contains(ss []string, v string) bool {
 // (real AssetStore, nil ExplorationStore, taskID=0). Used by ToolResolve to inject
 // domain tools into agents (Auto, custom) that don't own a per-task ToolSet.
 // nil as → returns nil (no injection, graceful degradation).
+//
+// The nil ExplorationStore is deliberate — these instances are task-less by
+// construction — so every tool here must tolerate it. Asset/company tools do
+// (they only need the AssetStore); the exploration-graph tools refuse with a
+// clear message via ToolSet.needExploration. Binding one of them to a task-less
+// agent in the tools table is therefore a useless tool, not a crash.
 func buildDomainReg(as *db.AssetStore) map[string]actool.CoreTool {
 	if as == nil {
 		return nil