feat(config): add `subagent_tools` to complement `primary_tools` and unifies tool visibility under permission system #4958