fix(agent): fix minor bugs in coordinator and view tool

[huaiyuWangh]

Summary

• Fix misleading error message: report "small model provider not configured" instead of "large" when the small model provider is missing
• Fix error handling order in view tool: check readTextFile error before UTF-8 validation to avoid validating partial/empty content
• Fix MCP tool filtering: move "MCP not allowed" log into correct branch and break after tool is added to prevent duplicate additions

Test plan

• Verify small model provider missing error shows correct message
• Verify view tool returns proper error when file read fails
• Verify MCP tool filtering logs correctly and doesn't duplicate tools

General approach: avoid logging the raw shell command string when it may contain secrets, or sanitize it before logging. We still want to keep useful diagnostics (e.g., that a command finished and whether there was an error), but without exposing sensitive contents.

Best minimal fix here: in internal/shell/shell.go, change the deferred log in execCommon so it no longer includes the command value, while keeping other context (like the error). This directly breaks the taint flow from API-key–derived values into logs and addresses all CodeQL variants, because they all converge on that sink.

Concretely:

• In execCommon, update the defer block to call s.logger.InfoPersist("command finished", "err", err) instead of logging "command", command.
• No new imports, types, or helpers are required; we simply reduce the logged fields.
• All other files (internal/agent/coordinator.go, internal/config/config.go, internal/config/resolve.go, internal/config/load.go) remain unchanged; they can continue to use Resolve and build commands, because we’ve removed the sensitive logging sink.

This preserves all functional behavior (commands still execute exactly the same, errors are still logged) while eliminating clear-text logging of potentially sensitive command text and embedded API keys.

---