Tool check-out / check-in / report-issue endpoints in the public API

Three new tool-action endpoints — POST /api/v1/tools/{id}/checkout (idempotent per actor, force-overrides existing checkouts), POST /api/v1/tools/{id}/checkin (records observed condition; BROKEN auto-spawns a HIGH-priority WorkOrder and returns the new workOrderId so you can deep-link the shop into it), POST /api/v1/tools/{id}/report (failure or replacement-request flow, optional markMissing). All three are tools:write and follow the same partial-success / cross-tenant-404 envelope as the rest of /api/v1.