_apply_sandbox_tools now checks the booted session's capabilities
before registering browser tools (BrowserExecTool, BrowserBatchExecTool,
RunBrowserSkillTool).
- If no session exists yet (first request), all tools are registered
conservatively to avoid breaking the initial interaction
- If a session exists without browser capability, browser tools are
omitted, preventing CapabilityNotSupportedError from Bay
- Skill lifecycle tools remain unconditionally registered