ContextState + private AstNode fields: enforce token_ids invariant

AstNode fields are now private with read-only accessors. All mutation
goes through ContextState methods (push, set_message, set_score, del)
which guarantee token_ids stays in sync with text on every leaf.

Also fix ResponseParser to use AstNode::tool_call() constructor,
widen parsing module visibility to pub(crate).

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/agent/api/mod.rs

@@ -7,7 +7,7 @@
 // Set POC_DEBUG=1 for verbose per-turn logging.
 
 pub mod http;
-mod parsing;
+pub(crate) mod parsing;
 mod types;
 mod openai;