Add deterministic toolset resolution ordering for default and custom toolsets

[davidahmann]

Problem
Toolset resolution with overlapping include/exclude/default inputs can produce non-deterministic exposure ordering, making policy verification and reproducibility harder.

Why now
Predictable capability exposure is required for governance and deterministic client behavior.

Expected behavior
Given equivalent config, resolved toolset ordering is deterministic and testable.

Acceptance criteria

• Toolset resolution emits stable ordering for equivalent inputs.
• Overlapping include/exclude resolution remains semantically correct.
• Tests cover default+custom overlap scenarios.

Evidence packet

• Commit under test: bf64678
• Runtime environment: macOS Darwin 25.3.0 arm64, Go 1.25.7
• Minimal repro:
  1. Resolve toolsets repeatedly with same include/exclude config.
  2. Compare resolved tool list order.
• Expected: deterministic stable order.
• Actual: ordering is not guaranteed by contract/tests.