fix: support authoritative tool parameter bindings

[chubes4]

Summary

• add an explicit authoritative: true parameter-binding contract so resolved host context wins over tool-call input
• reject caller substitutes when authoritative context is absent, while preserving explicit 0, false, null, and authoritative defaults
• remove authoritative parameters from provider-facing model schemas and validate malformed or unknown binding metadata

Compatibility and API notes

• ordinary bindings retain their existing caller/model-wins behavior
• authoritative is optional and must be boolean; normalized declarations retain it only when true
• supported binding metadata is now explicit: source, path, sensitive, default, and authoritative; unknown fields fail declaration validation
• absent authoritative values are removed before required-parameter validation, so required bindings fail safely rather than accepting model input

Test evidence

• php tests/tool-runtime-smoke.php
• php tests/default-provider-turn-adapter-smoke.php
• composer smoke
• composer phpstan
• composer validate --strict
• syntax checks for all changed PHP files
• git diff --check

Fixes #446

[chubes4]

Addressed the independent review blockers in ea26a4d:

• authoritative precedence is now context > binding-local default > top-level parameter default > absent, with caller input excluded throughout
• explicit 0, false, null, and top-level default cases are covered
• authoritative fields are removed recursively from allOf/anyOf/oneOf composition branches
• sanitization now happens in WP_Agent_Provider_Turn_Request, so custom and default adapters receive the same safe declaration
• execution tamper resistance and ordinary caller-wins bindings remain covered

Validation passed: focused runtime/provider/default-adapter smoke tests, full composer smoke, composer phpstan, composer validate --strict, PHP syntax checks, and git diff --check.