Audit Finding (Architecture, Medium)

Location: crates/agnix-core/src/config/builder.rs:221

build_unchecked() is public and bypasses all validation. Only agnix-wasm uses it externally.

Fix: Add a dedicated build_with_lenient_tools() that only skips tool name validation while preserving glob pattern validation and path traversal checks. Make build_unchecked() visible only to workspace crates or feature-gate it.

Found by /audit-project