fix: address audit findings — SDK plumbing, TUI bus, dead code

Critical fixes:

- ``StrixOrchestrationHooks.on_agent_start`` now finds the
  ``CaidoCapability`` via ``ctx.context['caido_capability']`` instead
  of ``agent.capabilities`` (we use plain ``Agent``, not
  ``SandboxAgent``, so the latter never existed). The session
  manager's bundle already exposes the capability; ``run_strix_scan``
  threads it through ``make_agent_context`` and ``create_agent``
  forwards it to children.

- ``run_strix_scan`` registers the ``StrixTracingProcessor`` with the
  SDK's tracing provider via ``add_trace_processor`` so SDK trace
  spans hit ``run_dir/events.jsonl`` (was previously a parallel stream
  the SDK ignored).

- ``on_llm_end`` now writes to ``Tracer.record_llm_usage`` in
  addition to ``bus.record_usage`` so the CLI/TUI stats panel sees
  real numbers instead of zeros.

- ``run_strix_scan`` accepts an externally-built ``AgentMessageBus``
  + an explicit ``model`` arg. The TUI pre-creates the bus so its
  stop and chat-input handlers can submit ``bus.send`` /
  ``bus.cancel_descendants`` coroutines onto the scan thread's loop
  via ``asyncio.run_coroutine_threadsafe`` — replacing the
  TODO-stub no-ops.

- ``model`` config now propagates root → context → child agents in
  ``create_agent`` (was hardcoded fallback).

Dead-code removal:

- Deleted the ``load_skill`` tool entirely (host module, sandbox
  module, TUI renderer, tests). The legacy implementation reached
  into a global ``_agent_instances`` registry that no longer exists;
  the post-migration stub returned ``success=True`` without
  injecting anything — pure theater. Skills are still preloaded via
  the system prompt at scan-bring-up.

- Dropped ``tenacity`` and ``xmltodict`` from
  ``[project.dependencies]`` — neither is imported anywhere
  post-migration.

- Stripped the system prompt's "use the load_skill tool" lines.

Tests: 278/278 passing. Removed two ``load_skill`` test cases and a
``test_tool_registration_modes::test_load_skill_import_...`` assertion
that exercised the deleted module.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pyproject.toml

@@ -35,12 +35,10 @@ classifiers = [
 dependencies = [
   "litellm[proxy]>=1.83.0",
   "openai-agents[litellm]==0.14.6",
-  "tenacity>=9.0.0",
   "pydantic[email]>=2.11.3",
   "rich",
   "docker>=7.1.0",
   "textual>=6.0.0",
-  "xmltodict>=0.13.0",
   "requests>=2.32.0",
   "cvss>=3.2",
   "traceloop-sdk>=0.53.0",
@@ -119,7 +117,6 @@ pretty = true
 [[tool.mypy.overrides]]
 module = [
     "litellm.*",
-    "tenacity.*",
     "numpydoc.*",
     "rich.*",
     "IPython.*",
@@ -294,7 +291,6 @@ ignore = [
 "strix/tools/web_search/tool.py" = ["TC002"]
 "strix/tools/file_edit/tools.py" = ["TC002"]
 "strix/tools/reporting/tool.py" = ["TC002"]
-"strix/tools/load_skill/tool.py" = ["TC002"]
 "strix/tools/finish/tool.py" = ["TC002"]
 "strix/tools/browser/tool.py" = ["TC002"]
 "strix/tools/terminal/tool.py" = ["TC002"]
@@ -420,7 +416,7 @@ force_grid_wrap = 0
 use_parentheses = true
 ensure_newline_before_comments = true
 known_first_party = ["strix"]
-known_third_party = ["fastapi", "pydantic", "litellm", "tenacity"]
+known_third_party = ["fastapi", "pydantic", "litellm"]
 
 # ============================================================================
 # Pytest Configuration