refactor: nuke gratuitous XML serialization + delete argument_parser

Argument parser:
- Delete ``strix/tools/argument_parser.py`` and its tests. The SDK
  validates and types tool arguments via Pydantic before they hit our
  wrappers, and the in-container tool server receives JSON-typed
  kwargs over the wire. The string-coercion belt-and-suspenders is no
  longer pulling its weight.

XML → JSON / typed structures:
- ``create_vulnerability_report``: ``cvss_breakdown`` is now a
  ``dict[str, str]`` of the 8 metrics; ``code_locations`` is a
  ``list[dict]``. No more XML parsing in the tool or the renderer.
- ``check_duplicate``: the dedup judge now emits a single JSON object
  instead of an ``<dedupe_result>`` block. Strict JSON parser handles
  optional code-fence wrappers.
- ``agent_finish``: completion report posted to the parent inbox is a
  JSON object (``kind``, ``from``, ``agent_id``, ``success``,
  ``summary``, ``findings``, ``recommendations``) rather than a
  hand-rolled ``<agent_completion_report>`` XML envelope.
- ``create_agent``: identity preamble + inherited-context markers are
  plain bracketed labels rather than ``<agent_delegation>`` /
  ``<inherited_context_from_parent>`` envelopes.
- ``inject_messages_filter``: peer messages get a
  ``[Message from agent <id> | type=... | priority=...]`` header line
  instead of an ``<inter_agent_message>`` envelope.
- Crash + system-warning messages: bracketed labels, no XML.
- System prompt: the inter-agent block now describes the new header
  format and drops the "never echo XML envelope" rule.
- ``strix/llm/utils.py``: deleted. ``clean_content`` collapsed into a
  one-line blank-line normalizer in the agent-message renderer (the
  XML envelope scrub had nothing left to scrub).

Tests updated to match the new shapes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/tools/test_sandbox_tools.py

@@ -1,7 +1,7 @@
-"""Phase 2.5 smoke tests for the sandbox-bound SDK tool wrappers.
+"""Smoke tests for the sandbox-bound SDK tool wrappers.
 
-Covers: browser_action, terminal_execute, python_action, and the seven
-Caido proxy tools.
+Covers: browser_action, terminal_execute, python_action, file_edit
+helpers, and the seven Caido proxy tools.
 
 These wrappers are pure pass-throughs to ``post_to_sandbox`` — there's
 no per-tool logic to assert, so the tests focus on:
@@ -9,9 +9,9 @@ no per-tool logic to assert, so the tests focus on:
 - ``FunctionTool`` registration succeeds (which proves the SDK could
   derive a JSON schema from the type hints — a non-trivial check given
   Literal types, ``dict[str, str]``, and strict-mode opt-outs).
-- The dispatch payload to ``post_to_sandbox`` mirrors the legacy XML
-  schema verbatim, so the in-container tool server gets the same
-  ``kwargs`` shape it always has.
+- The dispatch payload to ``post_to_sandbox`` carries the right
+  ``kwargs`` shape so the in-container tool server can dispatch to the
+  matching action.
 - The ``send_request`` / ``repeat_request`` tools opt out of strict
   schema mode (their ``headers`` / ``modifications`` dicts are
   free-form and would otherwise fail registration).