Tighten tool surface consistency

Four passes of audit-and-patch on the tool surface, condensed.

Tool API shape:
- Todo tools collapse to a single list-based form (one arg per tool,
  always a list, no dual-mode validator). Result-field names line up
  across the family — created_count / updated_count / marked_count /
  deleted_count, and _mark returns a single "marked" key plus the new
  status instead of marked_done / marked_pending.
- list_notes splits the overloaded total_count into filtered_count
  (matches) and total_count (grand total), matching list_todos. All
  three notes mutations now echo total_count and note_id.
- finish_scan drops the machine-code error strings; a single human
  "error" key carries the reason on every failure path.
- scope_rules delete echoes a message so the renderer's success
  branch has something to surface.

Failure-key unification: every tool now uses {"success": False,
"error": "..."} on failure paths. Touched thinking, web_search,
reporting, and finish. Trailing periods on error strings swept clean
across the whole tool tree.

Tool prompts (docstring re-imports vs main):
- create_vulnerability_report re-imports the CWE reference catalog,
  multi-part fix rules, fix_before/fix_after PR-suggestion mechanics,
  the COMMON MISTAKES list, the informational-vs-actionable
  distinction, and file-path examples.
- web_search re-imports concrete example queries.
- list_sitemap docstring fixed hasDescendants -> has_descendants
  (the camelCase reference never matched our snake_case schema).
- create_agent.skills description "Comma-separated" -> "List of".
- factory.py module docstring no longer claims there's no runtime
  skill-loading tool. agents_graph module docstring lists stop_agent.
- system_prompt nudges loading the matching skill before guessing
  payloads or syntax from memory.

TUI:
- proxy_renderer was reading stale field names from the pre-SDK
  schema (requests / total_count / statusCode / matches /
  showing_lines); now reads entries / page_info / status_code / hits
  / page+total_lines. Three proxy operations were rendering empty
  before this.
- Idle-pane placeholder text trimmed to "Loading...".

strix/tools/notes/tools.py

@@ -196,6 +196,7 @@ def _create_note_impl(
                 "success": True,
                 "note_id": note_id,
                 "message": f"Note '{title}' created successfully",
+                "total_count": len(_notes_storage),
             }
 
 
@@ -214,9 +215,15 @@ def _list_notes_impl(
                 "success": False,
                 "error": f"Failed to list notes: {e}",
                 "notes": [],
+                "filtered_count": 0,
                 "total_count": 0,
             }
-    return {"success": True, "notes": notes, "total_count": len(notes)}
+        return {
+            "success": True,
+            "notes": notes,
+            "filtered_count": len(notes),
+            "total_count": len(_notes_storage),
+        }
 
 
 def _get_note_impl(note_id: str) -> dict[str, Any]:
@@ -267,7 +274,9 @@ def _update_note_impl(
             _persist()
             return {
                 "success": True,
+                "note_id": note_id,
                 "message": f"Note '{note['title']}' updated successfully",
+                "total_count": len(_notes_storage),
             }
 
 
@@ -285,7 +294,9 @@ def _delete_note_impl(note_id: str) -> dict[str, Any]:
             _persist()
             return {
                 "success": True,
+                "note_id": note_id,
                 "message": f"Note '{note_title}' deleted successfully",
+                "total_count": len(_notes_storage),
             }
 
 
@@ -377,7 +388,7 @@ async def list_notes(
 
 @function_tool(timeout=30)
 async def get_note(ctx: RunContextWrapper, note_id: str) -> str:
-    """Fetch one note by its 5-char ID. Returns the full content.
+    """Fetch one note by its 6-char ID. Returns the full content.
 
     Args:
         note_id: Note id from ``create_note`` or a ``list_notes`` entry.
@@ -402,7 +413,7 @@ async def update_note(
     ``get_note``, concat, and pass the result.
 
     Args:
-        note_id: Target note's 5-char ID.
+        note_id: Target note's 6-char ID.
         title: New title, or ``None`` to keep.
         content: New content, or ``None`` to keep.
         tags: New tags list, or ``None`` to keep.