Seed per-agent config if missing; subclasses may assert required tools.
Default forbids Pi-facing write / read. Override to change.
| config |
application config |
| tools |
manager tool map (after fill_tools when asserts need them) |