Merge PR #2905 from cyq1017: name the allow_shell blocker in shell tool errors

Missing-shell-tool errors now state that allow_shell = false is the cause, with the existing /config remediation hint. Related #2657.

crates/tui/src/core/engine/tests.rs

@@ -3398,6 +3398,10 @@ fn missing_shell_tool_error_message_names_allow_shell_gate() {
     ] {
         let message = missing_tool_error_message(tool_name, &catalog);
         assert!(message.contains("not available in the current tool catalog"));
+        assert!(
+            message.contains("allow_shell = false"),
+            "{tool_name}: {message}"
+        );
         assert!(message.contains("allow_shell"), "{tool_name}: {message}");
         assert!(
             message.contains("/config allow_shell true"),
@@ -3426,6 +3430,7 @@ fn missing_shell_tool_error_message_keeps_allow_shell_hint_with_suggestions() {
 
     assert!(message.contains("Did you mean:"));
     assert!(message.contains("exec"));
+    assert!(message.contains("allow_shell = false"));
     assert!(message.contains("allow_shell"));
     assert!(message.contains("/config allow_shell true"));
     assert!(message.contains("--save"));

crates/tui/src/core/engine/tool_catalog.rs

@@ -535,7 +535,8 @@ pub(super) fn missing_tool_error_message(tool_name: &str, catalog: &[Tool]) -> S
 }
 
 fn shell_tool_allow_shell_hint() -> &'static str {
-    "Shell tools require top-level `allow_shell = true`. \
+    "Shell tools are disabled because top-level `allow_shell = false`; \
+     they require `allow_shell = true`. \
      In Agent mode, run `/config allow_shell true` for this session or add `--save` \
      for future sessions; the next turn will expose shell with approval gating"
 }