[codex] Add reaction tool contract coverage

[axisrow]

Summary

• Add the send_reaction agent tool and wire it through the existing TelegramActionService contract instead of direct Telethon calls.
• Register the new tool across Deepagents, permissions, action inventory, parity docs, CLI docs, and agent tool reference docs.
• Harden the agent tool contract with registry/permissions/docs checks, all-tool Deepagents smoke coverage, service-delegation guards, focused unit tests, and a manual real-Telegram sandbox smoke test.
• Keep pipeline read-only pages on account summaries so encrypted sessions do not need to be decrypted for rendering, with route coverage for that behavior.

Validation

• python3 -m ruff check src/ tests/ conftest.py
• python3 -m pytest tests/test_agent_tool_smoke_contract.py tests/test_agent_tools_deepagents_sync.py tests/test_agent_tools_messaging.py tests/test_telegram_action_contract.py tests/test_agent_tools_permissions.py tests/test_real_telegram_policy.py tests/test_agent_tools_real_telegram.py -v (152 passed, 1 skipped)
• python3 -m pytest tests/ -v -m aiosqlite_serial (822 passed, 6958 deselected)
• python3 -m pytest tests/ -v -m "not aiosqlite_serial" -n auto (6956 passed, 3 skipped)

The real Telegram sandbox test is present but skipped by default unless the manual live-test environment is enabled.