feat: support externally executed tool calls from OpenAI-compatible streams

[jeannotdamoiseaux]

Body

Closes #580

Summary

Adds an opt-in execution ownership extension for OpenAI-compatible streamed tool calls. A trusted endpoint can mark an individual normal tool_calls delta as externally executed. The agents runtime retains the native tool-call lifecycle but does not look up or invoke a local tool for that call.

This is provider-neutral and preserves the existing default: calls without valid opt-in metadata remain locally owned.

Behavior

• Normal OpenAI-compatible tool-call deltas can include execution.mode: external and an optional provider identifier.
• Ownership is accepted only when the client configuration enables external execution and the provider matches the optional allowlist.
• Valid externally owned calls bypass local tool lookup and invocation.
• Tool-call ownership propagates through streamed content, completed tool records, and graph routing.
• When a response contains only external calls, the graph ends locally instead of attempting a redundant tool round.
• Assistant text following a tool call in the same response is retained.

Safety

• Disabled by default.
• Malformed ownership metadata is ignored.
• An unapproved provider is ignored.
• Existing local tools and unknown local-tool behavior are unchanged.
• No workflow engine, bridge, deployment, or product-specific terminology is introduced.

Tests

• Added approved-provider stream normalization coverage.
• Added unapproved-provider rejection coverage.
• Ran npx tsc --noEmit.
• Ran ESLint for all changed source and test files.
• Ran npx jest src/llm/openai/sequentialToolCallSeals.test.ts --runInBand: 23 passing tests.

Related work

The companion LibreChat application change is tracked by LibreChat-AI/LibreChat#16498. That change exposes endpoint configuration, preserves ownership in the UI model, renders the existing native card correctly, and documents the stream extension.