Fix: Automatically sanitize tool names to valid JavaScript identifiers

[dankelleher]

Problem

MCP tools commonly use kebab-case naming conventions (e.g., get-profile, send-message) which are not valid JavaScript identifiers. When using these tools with tool-scripting, the LLM receives instructions to "call functions directly" (e.g., await get_profile(...)), but tool names with dashes cannot be called this way in JavaScript.

This causes runtime errors like:

Script error: get_profile is not defined

The LLM intelligently converts dashes to underscores when generating code, but the actual bindings in the sandbox still use the original names with dashes.

Solution

This PR adds automatic tool name sanitization to ensure tool names are valid JavaScript identifiers:

1. Added sanitizeToolName() helper - Converts any non-JS-friendly characters (dashes, dots, etc.) to underscores
2. Updated extractToolBindings() - Sanitizes names when creating sandbox bindings
3. Updated generateCodeSystemPrompt() - Uses sanitized names in documentation so the system prompt matches what's available

Example

Before:

// Tool registered as: global["get-profile"]
// LLM tries to call: get_profile(...)
// Result: ReferenceError

After:

// Tool registered as: global.get_profile
// LLM calls: get_profile(...)
// Result: Works! ✅