fix(hub): expose TodoWrite via SDK default toolset

Unrestricted roles were still passed an explicit --tools name list. The
native Claude binary only reliably registers bundled tools like TodoWrite
on --tools default. Treat role tools JSON null as unrestricted, use the
claude_code preset (→ default) in that case, and keep TodoWrite on allowedTools.

hub/src/agent/roleTools.ts

@@ -77,8 +77,11 @@ const SUPPORTED_ROLE_TOOLS = new Set([
   ...Object.keys(ROLE_TOOL_TO_CPH_HUB_MCP_TOOLS),
 ]);
 
-export function claudeSdkToolConfigForRole(roleTools: readonly string[] | undefined): ClaudeSdkToolConfig {
-  if (roleTools === undefined) {
+export function claudeSdkToolConfigForRole(
+  roleTools: readonly string[] | null | undefined,
+): ClaudeSdkToolConfig {
+  // DB/runtime "unrestricted" is JSON null; treat the same as undefined.
+  if (roleTools === undefined || roleTools === null) {
     const mcpTools = CPH_HUB_MCP_TOOL_IDS.map(claudeMcpToolName);
     return {
       tools: [...DEFAULT_CLAUDE_BUILT_IN_TOOLS],
@@ -103,8 +106,10 @@ export function claudeSdkToolConfigForRole(roleTools: readonly string[] | undefi
   return { tools: builtIns, allowedTools };
 }
 
-export function cphHubMcpToolsForRole(roleTools: readonly string[] | undefined): readonly CphHubMcpToolId[] {
-  if (roleTools === undefined) return [...CPH_HUB_MCP_TOOL_IDS];
+export function cphHubMcpToolsForRole(
+  roleTools: readonly string[] | null | undefined,
+): readonly CphHubMcpToolId[] {
+  if (roleTools === undefined || roleTools === null) return [...CPH_HUB_MCP_TOOL_IDS];
 
   const tools: CphHubMcpToolId[] = [];
   for (const roleTool of roleTools) {
@@ -116,8 +121,11 @@ export function cphHubMcpToolsForRole(roleTools: readonly string[] | undefined):
   return tools;
 }
 
-export function roleToolsAllow(roleTools: readonly string[] | undefined, roleTool: string): boolean {
-  if (roleTools === undefined) return true;
+export function roleToolsAllow(
+  roleTools: readonly string[] | null | undefined,
+  roleTool: string,
+): boolean {
+  if (roleTools === undefined || roleTools === null) return true;
   for (const configured of roleTools) {
     assertSupportedRoleTool(configured);
     if (configured === roleTool) return true;