parser: reject unsafe Gemma 4 tool calls

[pd95]

Motivation

Gemma 4 tool-call parsing includes a best-effort repair path for malformed
model output. A preserved control token inside unfinished arguments could be
mistaken for the end of a call, allowing a truncated prefix to be repaired into
valid JSON and returned as an executable tool call. Other malformed events
could be silently dropped rather than surfaced to the caller.

Model-generated tool arguments are untrusted input. Repair must not turn
control-token injection or incomplete structured output into a command an
agent may execute.

What this changes

• retains raw tool-call events until the parser can validate the full call;
• rejects Gemma control tokens and non-whitespace control characters before
  attempting repair;
• rejects a close token while a quoted string or argument object is incomplete;
• rejects otherwise unsafe or unrepresentable call shapes;
• reports an empty tool-call block at end of generation as malformed;
• preserves valid multiline calls and the existing control-free legacy repair
  behavior.

Dependency and scope

This PR depends on custom apply_patch PR #10 and changes only the Gemma 4
parser and its safety tests. It does not change Gemma model execution or media
support.

Compare:
feature/responses-custom-apply-patch-tool...fix/gemma4-tool-call-safety

Validation

Focused parser tests cover split streaming tokens, raw and quoted truncation,
control characters, empty calls, valid repairs, and chunked multiline content.
The complete model/parsers package, integrated Linux test/lint/build, and
Darwin MLX build gates pass.

Refresh and AI assistance

Reconstructed on Ollama v0.34.0; head
64018404c0fec31e08ecea52ee1ca3f254ea87c3. Codex materially assisted
implementation review, tests, refresh validation, and this PR description.