ContextState + private AstNode fields: enforce token_ids invariant

AstNode fields are now private with read-only accessors. All mutation
goes through ContextState methods (push, set_message, set_score, del)
which guarantee token_ids stays in sync with text on every leaf.

Also fix ResponseParser to use AstNode::tool_call() constructor,
widen parsing module visibility to pub(crate).

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/agent/api/mod.rs

@@ -7,7 +7,7 @@
 // Set POC_DEBUG=1 for verbose per-turn logging.
 
 pub mod http;
-mod parsing;
+pub(crate) mod parsing;
 mod types;
 mod openai;
 

src/agent/api/parsing.rs

@@ -17,7 +17,7 @@ use super::types::{ToolCall, FunctionCall};
 /// Looks for `<tool_call>...</tool_call>` blocks and tries both
 /// XML and JSON formats for the body.
 /// Parse a single tool call body (content between `<tool_call>` and `</tool_call>`).
-pub(super) fn parse_tool_call_body(body: &str) -> Option<ToolCall> {
+pub(crate) fn parse_tool_call_body(body: &str) -> Option<ToolCall> {
     let normalized = normalize_xml_tags(body);
     let body = normalized.trim();
     let mut counter = 0u32;