feat(context): bound per-tool output before it enters agent history

Cap the size of every tool result so a single verbose command (recursive
find, noisy scanner, full page dump) can't pin the conversation near the
model's context window for the rest of a scan.

- New ContextSettings config group with env-tunable caps.
- Default the SDK shell tools' max_output_tokens so exec_command /
  write_stdin truncate head+tail instead of returning unbounded output.
- Bound Strix's own FunctionTool/CustomTool results (line + UTF-8 byte
  head+tail preview with a truncation notice) and cap error strings.

tests/test_agent_factory_shell.py

@@ -9,6 +9,7 @@ import pytest
 from agents.tool import FunctionTool
 
 from strix.agents import factory
+from strix.config import load_settings
 
 
 def _capturing_exec_tool(captured: dict[str, str]) -> FunctionTool:
@@ -32,10 +33,23 @@ async def test_wrap_exec_command_defaults_shell_to_bash() -> None:
     result = await wrapped.on_invoke_tool(cast("Any", None), json.dumps({"cmd": "source /tmp/env"}))
 
     assert result == "ok"
-    assert json.loads(captured["raw_input"]) == {
-        "cmd": "source /tmp/env",
-        "shell": "bash",
-    }
+    parsed = json.loads(captured["raw_input"])
+    assert parsed["cmd"] == "source /tmp/env"
+    assert parsed["shell"] == "bash"
+    expected_cap = load_settings().context.tool_output_max_tokens
+    assert parsed["max_output_tokens"] == expected_cap
+
+
+@pytest.mark.asyncio
+async def test_wrap_exec_command_preserves_explicit_output_cap() -> None:
+    captured: dict[str, str] = {}
+    wrapped = factory._wrap_exec_command(_capturing_exec_tool(captured))
+
+    await wrapped.on_invoke_tool(
+        cast("Any", None), json.dumps({"cmd": "echo hi", "max_output_tokens": 42})
+    )
+
+    assert json.loads(captured["raw_input"])["max_output_tokens"] == 42
 
 
 @pytest.mark.asyncio