feat: new tools, run cancellation, custom memory, groups, skill self-review

[jasonli0226]

Engine & tools

• Web fetch enhancements and 12-tool browser_* toolset backed by a sandboxed Chromium sidecar (clawix-browser) with internal-allowlist egress controls and per-policy session/CDP gating.
• Governed Python tools (python_run, python_run_net) with warm sibling pool, ephemeral net runs, and a clawix-pypi-proxy sidecar enforcing per-tier package allowlists.
• Agent run cancellation: POST /api/v1/chat/agent-runs/stop aborts a user's running runs in ~1s via an in-process AgentRunRegistry plumbed through ReasoningLoop → ToolRegistry; cancelled state is distinct from failed and protected from clobber.

Memory & collaboration

• Custom per-user MemoryItem store with domain: tag convention, /memory kanban (Mine / Visible to me), and org-wide sharing via the existing MemoryShare(targetType=ORG) primitive — both the editor toggle and the share_memory agent tool write the same row.
• Self-service group management at /governance/groups: create groups, invite by email with state-machine-guarded transitions, accept/reject via the bell-icon notification mailbox, owner-only delete/remove.

Skills

• Skill staleness metadata and a self-review flow so skills can flag themselves for revision.

Docs

• Specs and implementation plans for python_run, browser tools, custom memory, group management, agent-run cancellation, and skill self-review.
• Updated README.md and GETTING_STARTED.md for the new sidecars and required env vars (BROWSER_AUTH_TOKEN, PYTHON_PROXY_AUTH_TOKEN, per-policy controls).