feat(loop): Top5#4 工具循环增强（对齐 OpenClaw agent-loop）——重复检测/并行串行/钩子/errorKind/repair

- 重复调用安全网（critical-tool-loop）：指纹=name+canonical JSON(args)；批内重复第二次跳过回喂
  「duplicate call」；跨轮关键重复(同指纹重现)→首次 block+criticalSeen，再次连续重复→终止整轮
  StopReasonToolLoopTerminated（替代裸 8 轮针对同调用的硬截止）。
- 并行/串行混合：invokeParallel 默认并行，信号量(ToolParallelism 默认4)限并发，结果按调用索引
  写回按原序渲染；串行触发=Options.ToolExecution:sequential 或 SetToolExecutionMode(name,sequential)
  （对齐 OpenClaw「一个 sequential 标记→整组串行」）；goroutine 不泄漏、ctx 取消快速返回。
- 工具钩子：ToolLoopHooks(BatchAdmit/CallAdmit/AfterCall/AfterOutcome) 经 Options.Hooks 注入，
  均 nil-tolerant；供后续敏感操作代审复用（design/11）。terminate 用 every 语义。
- status 分类：ToolError.Kind() 区分 argument-validation(JSON-Schema 失败)/execution；
  失败消息渲染 {kind,message} 让模型区分重发参数 vs 执行失败。
- tool-call-repair：LenientJSONUnmarshal 修 fence 包裹/尾逗号畸形；agent.extractToolCalls 与
  loop.decodeToolCalls 走它；不可修复退化为文本不崩整轮。意图调用未区分回喂提示(后置)。
- tool_execution_update：流式路径 emitToolExecution 发 StreamKindToolExecution(start/end/end:error)。

go build/vet/test 全绿(46包)。TestRun_MaxRounds 改每轮不同参(原同 echo 被安全网拦，预期新行为)。
-race 受宿主 TSan VMA 限制无法运行(与代码无关)。

internal/runtime/tool/tool.go

@@ -25,6 +25,28 @@ import (
 // override and the Dispatcher was built without WithDefaultTimeout.
 const DefaultTimeout = 30 * time.Second
 
+// Execution modes a tool may declare to the loop. A tool that mutates shared
+// state (file writes, device control) should be marked sequential so the loop
+// does not run it concurrently with other calls.
+const (
+	// ExecutionModeParallel is the default: the loop may run such a tool
+	// concurrently with other calls in a batch.
+	ExecutionModeParallel = "parallel"
+	// ExecutionModeSequential forces the loop to run the whole batch serially so
+	// this tool is never invoked concurrently.
+	ExecutionModeSequential = "sequential"
+)
+
+// Error-kind labels distinguishing why a tool call failed, fed back to the model
+// as a structured {kind,message} so it can react differently to a bad argument
+// (re-issue a corrected call) versus an execution failure.
+const (
+	// KindArgumentValidation marks a JSON-Schema argument-validation failure.
+	KindArgumentValidation = "argument-validation"
+	// KindExecution marks a runtime execution failure (timeout, panic, tool error).
+	KindExecution = "execution"
+)
+
 // Sentinel errors returned by the Dispatcher. Use errors.Is to test for them;
 // they are wrapped with %w so the underlying cause stays available.
 var (
@@ -64,6 +86,17 @@ func (e *ToolError) Error() string {
 // Unwrap exposes the wrapped cause so errors.Is/errors.As traverse the chain.
 func (e *ToolError) Unwrap() error { return e.cause }
 
+// Kind classifies the failure as "argument-validation" (the caller-supplied
+// arguments failed the JSON Schema) or "execution" (anything after validation:
+// unknown tool, timeout, panic or an Execute error). The loop uses it to feed a
+// structured {kind,message} tool result back to the model.
+func (e *ToolError) Kind() string {
+	if e.cause != nil && errors.Is(e.cause, ErrInvalidArgs) {
+		return KindArgumentValidation
+	}
+	return KindExecution
+}
+
 // Option configures a Dispatcher at construction time.
 type Option func(*Dispatcher)
 
@@ -72,8 +105,9 @@ type Option func(*Dispatcher)
 type Dispatcher struct {
 	reg      *registry.Registry
 	dft      time.Duration
-	mu       sync.RWMutex // guards timeouts
+	mu       sync.RWMutex // guards timeouts and modes
 	timeouts map[string]time.Duration
+	modes    map[string]string // tool name -> ExecutionMode* (default parallel)
 }
 
 // New builds a Dispatcher backed by reg, applying opts in order. It returns an
@@ -87,6 +121,7 @@ func New(reg *registry.Registry, opts ...Option) (*Dispatcher, error) {
 		reg:      reg,
 		dft:      DefaultTimeout,
 		timeouts: make(map[string]time.Duration),
+		modes:    make(map[string]string),
 	}
 	for _, opt := range opts {
 		if opt != nil {
@@ -125,6 +160,33 @@ func (d *Dispatcher) SetToolTimeout(name string, timeout time.Duration) error {
 	return nil
 }
 
+// SetToolExecutionMode marks a tool as running "sequential" or "parallel" (the
+// default). A sequential tool is never invoked concurrently by the loop, so
+// shared-state tools (file writes, device control) can declare it. An empty mode
+// clears the override back to the default. Only ExecutionModeSequential is
+// treated as sequential.
+func (d *Dispatcher) SetToolExecutionMode(name, mode string) error {
+	if name == "" {
+		return fmt.Errorf("tool: set execution mode: %w", ErrUnknownTool)
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if mode == "" || mode == ExecutionModeParallel {
+		delete(d.modes, name)
+		return nil
+	}
+	d.modes[name] = mode
+	return nil
+}
+
+// IsSequential reports whether the named tool has been declared sequential. An
+// unknown name or one never marked sequential reports false (the default).
+func (d *Dispatcher) IsSequential(name string) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	return d.modes[name] == ExecutionModeSequential
+}
+
 // Invoke executes the tool registered as name with the given args. It resolves
 // the tool from the registry, validates args against the tool's Parameters JSON
 // Schema, and runs Execute under the tool's deadline (per-tool override, else