For pro users, ask mode now uses the local agent handler in read-only
mode, giving them access to code reading tools (read_file, list_files,
grep, code_search, etc.) while preventing any state modifications.

Changes:
- Add `modifiesState` property to ToolDefinition interface
- Mark state-modifying tools (write_file, edit_file, delete_file,
rename_file, add_dependency, execute_sql, add_integration)
- Add `readOnly` option to buildAgentToolSet to filter out
state-modifying tools
- Add `readOnly` option to handleLocalAgentStream to skip commits/
deploys and exclude MCP tools in read-only mode
- Create LOCAL_AGENT_ASK_SYSTEM_PROMPT for read-only agent mode
- Route pro ask mode users to local agent with readOnly: true

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Enables read-only local-agent behavior for Pro users in `ask` mode,
providing code-inspection tools without allowing modifications.
> 
> - Route `ask` → local-agent with `readOnly: true` (when Pro and no
mentioned apps); persist `aiMessagesJson` for these modes
> - Add `modifiesState` to `ToolDefinition`; mark state-changing tools
and filter them in `buildAgentToolSet({ readOnly })`; exclude MCP tools
in read-only
> - Update `handleLocalAgentStream` to support `readOnly`: skip
commits/deploys and return `updatedFiles: false`
> - Introduce `LOCAL_AGENT_ASK_SYSTEM_PROMPT` and plumb `readOnly`
through `constructSystemPrompt`/`constructLocalAgentPrompt`
> - E2E: new ask-mode tests/fixtures and snapshot updates; add
deterministic normalization of tool_call IDs in test helper
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a67cbc1ccad35bf1fad9277bfce14a8999e763ca. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Pro ask mode now uses the local agent in read-only mode, letting users
read and search code without changing anything. Commits, deploys, and
state-modifying tools are disabled.

- **New Features**
- Route Pro ask mode to the local agent with readOnly: true when no
other apps/codebases are mentioned.
- Tools declare modifiesState;
write/edit/delete/rename/add_dependency/execute_sql/add_integration are
marked and excluded in read-only mode.
- buildAgentToolSet and handleLocalAgentStream support readOnly to
filter tools, skip MCP tools, and avoid commits/deploys (updatedFiles:
false).
- Added LOCAL_AGENT_ASK_SYSTEM_PROMPT and prompt wiring to support
read-only behavior.

<sup>Written for commit a67cbc1ccad35bf1fad9277bfce14a8999e763ca.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude <noreply@anthropic.com>