fix(core): reject malformed tool arguments and settle unfinished calls

[rekram1-node]

Reject broken arguments without delaying valid calls

flowchart TD
    A[Tool arguments stream] --> B[Partial preview stays available]
    A --> C{Final arguments decode as complete JSON?}
    C -->|Yes| D[Execute immediately on tool-call]
    C -->|No| E[AI emits tool-input-error]
    E --> F[Core records failure: not executed]
    G[Stream ends with an uncalled local tool] --> F
    F --> H[Existing tool-error continuation allows a corrected call]

Loading

 Final tool arguments
- Repair incomplete JSON, or fall back to {}
+ Reject malformed JSON; never execute repaired arguments

 Unfinished local call at step closeout
- Remain streaming indefinitely
+ Record an unexecuted tool failure

Ownership: packages/ai decodes arguments and emits call/error events. packages/core persists terminal tool state and owns continuation; its closeout sweep catches calls that parsers never finalized.

Unchanged: streaming previews, eager execution, empty input for zero-argument tools, and hosted-tool/refusal/transport handling. A completed valid call may already have executed before a later refusal or output limit. Text-only truncation continuation is out of scope.

Verification

• Local: full AI suite 1,777 passed, 28 skipped; focused Core suite 252 passed; both affected-package typechecks pass.
• CI: Linux unit tests, Linux E2E, and workspace typechecking pass.
• Windows unit failure: unrelated Npm.add Git-subdirectory installation test exceeded its 5-second timeout.
• Updates existing tests for strict final JSON parsing and terminal tool state; adds one regression for unfinished calls after an output limit. Existing suites continue to cover previews, valid calls, zero-argument tools, and error recovery.

Related issues

Fixes #52553

• session: truncated tool call left "streaming" — message undecodable (500), turn marked succeeded #52553: prevents newly unfinished local calls from remaining streaming; does not repair already-corrupted sessions or add client reconciliation.
• Anthropic refusal fires a truncated shell command instead of stopping #52532: rejects the reported malformed shell arguments rather than repairing and executing them; does not add whole-response refusal gating for valid completed calls.
• fix(llm): handle truncated OpenAI tool arguments #36766: enables recovery through a failed tool result rather than terminating the execution for malformed final local input; additional stream diagnostics are outside this change.