Reverse engineering tools per mode; raw firmware in decompile; skill

- AgentConfig.reverse_tools (Settings -> Agents & commands) gives any mode
  binary_info and decompile; the clean-room check of the tools applies to
  craft only (ToolCtx.clean_room = clean room && craft).
- decompile: optional processor (Ghidra language id) and base_address for raw
  images (BinaryLoader); separate cache per processor/address.
- Skill "reverse-engineering": identify, convert HEX, processor table for
  common chips, decompile, explore, notes in analysis/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/runner.rs

@@ -226,7 +226,12 @@ pub fn available_tools(app: &App, agent: &Agent, owner: Option<&crate::store::Us
     all.into_iter()
         .filter(|t| !agent.read_only || t.read_only())
         // Craft tools only where they are useful.
-        .filter(|t| agent.name == "craft" || !matches!(t.name(), "browser_snapshot" | "image_compare" | "binary_info" | "decompile" | "craft_phase") || agent.tools.is_some())
+        .filter(|t| {
+            agent.name == "craft"
+                || agent.tools.is_some()
+                || (agent.reverse && matches!(t.name(), "binary_info" | "decompile"))
+                || !matches!(t.name(), "browser_snapshot" | "image_compare" | "binary_info" | "decompile" | "craft_phase")
+        })
         .filter(|t| match &agent.tools {
             None => true,
             Some(list) => {
@@ -456,7 +461,8 @@ pub async fn run_session(app: Arc<App>, session_id: &str, cancel: CancellationTo
             agent: agent.name.clone(),
             roots: roots.clone(),
             sandbox: crate::sandbox::spec_for(&app, session.owner_id.as_deref()),
-            clean_room,
+            // Clean room is a craft rule; other modes with reverse tools may analyse binaries.
+            clean_room: clean_room && agent.name == "craft",
             owner_id: None,
         };
         let by_name = |n: &str| tools.iter().find(|t| t.name() == n).cloned();