fix(tools): wire manage_rag into tool dispatch (#5557)

[RavinduPabasara]

Summary

manage_rag was advertised to users (UI TOOL_GROUPS) and to nobody's benefit: it was absent from TOOL_TAGS and from every dispatch site, so agent tool blocks naming it were rejected as unknown before reaching a handler — models loop hunting for workarounds, as documented in #5557. The handler itself was alive and maintained (it received the #1660 data-loss fix), so the unwiring looks like accidental registry-era fallout (cf. #4277) rather than a deliberate removal — this PR takes the issue's "re-register" direction: recognize the fence tag, route it through dispatch_ai_tool next to manage_memory, and add manage_rag to NON_ADMIN_BLOCKED_TOOLS so re-wiring doesn't open a new non-admin capability (add_directory indexes arbitrary server paths — same sensitivity class as manage_memory/read_file, both gated).

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5557

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)

Checklist

• I searched open issues and open PRs — this is not a duplicate (manage_rag agent tool is advertised (TOOL_GROUPS) but never dispatched: do_manage_rag absent from TOOL_HANDLERS and builtin RAG MCP excluded from function schemas #5557 is the report; no other PR addresses it).
• This PR targets dev
• My changes are limited to the scope described above — 4 one-line wiring/gating edits + one test file; no unrelated refactors.
• I actually ran the app (uvicorn app:app) and verified the change works — details and the one thing I did not drive are in How to Test.

How to Test

1. python -m pytest tests/test_manage_rag_dispatch.py — 4 new regression tests: fence tag recognized, dispatch reaches do_manage_rag with session scope, public-user gating, user-disable handling. Hermetic (no chromadb), same style as test_rag_remove_directory_scope.py.
2. python -m pytest — 4,613 passed. The 4 failures in TestHostDockerAccess/test_cookbook_docker_access.py occur identically on clean dev on this machine (Docker-socket environment tests, macOS) — not introduced here.
3. Ran the app (uvicorn app:app, fresh sqlite env) — boots cleanly with the change, and exercising the real dispatch chain in the running install now reaches the handler:

   from src.tool_execution import execute_tool_block
   from src.agent_tools import ToolBlock
   await execute_tool_block(ToolBlock("manage_rag", "list"), session_id="s")
   # -> ("manage_rag: list", {"results": "Personal docs manager not available. RAG may not be configured."})
   On dev without this PR, the same block never reaches a handler ("unknown tool"). What I did not drive: a full chat turn with a live model emitting the fence block (no model endpoint in my test env) — the block→dispatch→handler path above is the changed surface.

4. On a configured deployment: ask the agent to "list what's in the RAG index" — it should call manage_rag and get a listing instead of looping.

Note: the destructive remove_directory action stays available to admin/single-user as-is, since #1660's collection-wipe bug is already fixed inside the handler. Happy to restrict dispatch to list/add_directory if you'd prefer the conservative surface.

No UI changes — nothing that renders was touched.