fix(providers): dedupe tool_use ids to prevent Anthropic 400s

Anthropic rejects any request where two tool_use blocks share an id
("messages.N.content.M: tool_use ids must be unique"). A mis-assembled
stream could surface the same tool_use block twice in one assistant turn;
the runner persisted it verbatim, so the malformed message was re-sent on
every subsequent turn and permanently bricked the session — the agent
silently stopped replying.

Fix at two layers:
- AnthropicProvider._parse_response: drop duplicate tool_use ids (keep
  first) as the response enters nanobot, so corruption is never persisted.
- AgentRunner._dedup_tool_calls: a new context-governance pass that dedupes
  assistant tool_calls and tool results by id before each send, healing any
  history that was already corrupted.

Add regression tests covering both the dedup and the no-op fast path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/agent/test_runner_governance.py

@@ -184,6 +184,63 @@ async def test_backfill_missing_tool_results_inserts_error():
     assert backfilled[0]["name"] == "read_file"
 
 
+def test_dedup_tool_calls_removes_duplicate_ids():
+    from nanobot.agent.runner import AgentRunner
+
+    messages = [
+        {"role": "user", "content": "hi"},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {"id": "a", "type": "function", "function": {"name": "x", "arguments": "{}"}},
+                {"id": "b", "type": "function", "function": {"name": "y", "arguments": "{}"}},
+                # Duplicate of "b" — would trigger "tool_use ids must be unique".
+                {"id": "b", "type": "function", "function": {"name": "y", "arguments": "{}"}},
+            ],
+        },
+        {"role": "tool", "tool_call_id": "a", "name": "x", "content": "ra"},
+        {"role": "tool", "tool_call_id": "b", "name": "y", "content": "rb"},
+        # Duplicate result for "b".
+        {"role": "tool", "tool_call_id": "b", "name": "y", "content": "rb-dup"},
+    ]
+
+    cleaned = AgentRunner._dedup_tool_calls(messages)
+
+    assert cleaned == [
+        {"role": "user", "content": "hi"},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {"id": "a", "type": "function", "function": {"name": "x", "arguments": "{}"}},
+                {"id": "b", "type": "function", "function": {"name": "y", "arguments": "{}"}},
+            ],
+        },
+        {"role": "tool", "tool_call_id": "a", "name": "x", "content": "ra"},
+        {"role": "tool", "tool_call_id": "b", "name": "y", "content": "rb"},
+    ]
+
+
+def test_dedup_tool_calls_noop_when_unique():
+    from nanobot.agent.runner import AgentRunner
+
+    messages = [
+        {"role": "user", "content": "hi"},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {"id": "a", "type": "function", "function": {"name": "x", "arguments": "{}"}},
+            ],
+        },
+        {"role": "tool", "tool_call_id": "a", "name": "x", "content": "ra"},
+    ]
+
+    # No duplicates -> identical list object returned (cheap no-op path).
+    assert AgentRunner._dedup_tool_calls(messages) is messages
+
+
 def test_drop_orphan_tool_results_removes_unmatched_tool_messages():
     from nanobot.agent.runner import AgentRunner