fix(hub): expose TodoWrite via SDK default toolset

Unrestricted roles were still passed an explicit --tools name list. The
native Claude binary only reliably registers bundled tools like TodoWrite
on --tools default. Treat role tools JSON null as unrestricted, use the
claude_code preset (→ default) in that case, and keep TodoWrite on allowedTools.

hub/test/unit/runner.test.ts

@@ -115,7 +115,7 @@ describe("runAgent", () => {
         settingSources: [],
         settings: { disableBundledSkills: true, todoFeatureEnabled: true },
         skills: [],
-        tools: expect.arrayContaining(["TodoWrite"]),
+        tools: { type: "preset", preset: "claude_code" },
         allowedTools: expect.arrayContaining(["TodoWrite"]),
         strictMcpConfig: true,
         sandbox: expect.objectContaining({