fix(report-agent): tolerate prose/fences around <tool_call> JSON

[PRATHAMESH75]

What

Parses the <tool_call>…</tool_call> body with the balanced-brace extractor
(app/utils/llm_sanitizer.extract_json_block) instead of the lazy
<tool_call>\s*(\{.*?\})\s*</tool_call> regex.

Why

The old regex required the JSON object to start immediately after the tag
and end immediately before </tool_call>. When a reasoning model added text
inside the tag around the JSON, the whole tool call was silently dropped:

<tool_call> body	old	new
clean {…nested parameters…}	✅	✅ (no change)
JSON + trailing note in tag	❌ dropped	✅ parsed
leading prose before JSON in tag	❌ dropped	✅ parsed
```json fenced JSON in tag	❌ dropped	✅ parsed

Note: this is a robustness hardening, not a nested-parameters fix.
Clean nested objects already parsed — the </tool_call> anchor backtracks the
lazy regex to the outer brace. An earlier diagnosis that nested params were
dropped did not reproduce; a guard test documents that they keep working.

Tests

Adds leading-text, trailing-text, and fenced-JSON cases (each fails on the
old regex, passes now) plus a nested-params guard. Full backend suite: 100 passed.

🤖 Generated with Claude Code