fix: accept complete fenced JSON tool requests

[er-s-an]

Summary

• unwrap a single code fence when the entire assistant reply is one valid tool-request JSON object
• support both json-tagged and untagged fences while keeping the execution boundary fail-closed for prose, malformed fences, multiple fences, and non-tool JSON
• update the helper DOX contract and expand the existing normalization regression suite

Fixes #1811

Why

is_misformatted_tool_request() already recognizes fenced tool JSON, but extract_tool_request() only accepted bare JSON. A correct tool call wrapped by a chat model in one Markdown fence therefore entered the misformat circuit breaker instead of executing.

The parser remains intentionally strict: it only unwraps a fence when fullmatch() covers the complete trimmed reply, then applies the existing complete-root and tool-envelope checks.

Verification

• python -m pytest -q tests/test_tool_request_normalization.py — 27 passed
• python -m compileall -q helpers/extract_tools.py
• git diff --check origin/main...HEAD