Add stack-agnostic tool acquisition guidance

[fall-out-bug]

Summary

• adds stack-agnostic acquisition guidance to oss-plan.json tool plans
• makes candidate tools explicit as local producer options, not Portolan-owned PHP/JVM/Gradle adapters
• keeps candidate/installed tools not_assessed until local output exists and context is refreshed
• records fresh Bigtop context smoke, Cursor Agent composer-2.5 stress, and review disposition

Verification

• go test ./internal/contextprep
• go test ./...
• go vet ./...
• jq empty schema/*.json
• git diff --check
• fresh Bigtop context smoke
• Cursor Agent composer-2.5 bounded tool acquisition stress
• review lanes: Kimi, DeepSeek, Qwen; degraded MiMo/MiniMax attempts recorded

Evidence boundaries

• No native producer, install, Maven, Gradle, Syft, jscpd, Semgrep, Docker, or runtime command was executed by this PR.
• Tool availability is not evidence. Candidate tools remain not_assessed until local output is produced and re-ingested.
• This PR does not add a stack-specific adapter or scanner.

Readiness

• Ready-for-review PR: yes, pending current GitHub checks.
• Ready-to-merge PR: no; explicit merge approval and GitHub review approval are not assessed.