fix: clear CodeQL alerts on agent_tools tool registration

[suguanYang]

Closes the remaining CodeQL findings that were auto-posted as comments on the main→staging PR #396. Three of the seven alerts (417–419: redundant stop_reason assignment, 2× implicit string concatenation) were already fixed on main by the Copilot-Autofix commits b6a95a8f/7a0a51b8 — no further work needed there.

Changes

1. harness/base.py — CodeQL statement has no effect (alert 420): the ... placeholder inside the Harness Protocol method is dead code. Replaced with raise NotImplementedError, matching the convention used by other Protocols in this repo.

2. agent_tools/__init__.py — the tool-registration side-effect import (each module under tools/ calls @register_tool at import time) is now performed by the package itself, so any consumer importing a name from this package (e.g. REGISTRY) is guaranteed a fully populated registry. _tools is listed in __all__ as a deliberate re-export (ruff already ignores F401 in __init__.py).

3. Dropped the 3 redundant import tools as _agent_tools_registered # noqa: F401 lines in dynamic_tools.py, cursor_harness.py, openai_harness.py — CodeQL unused import alerts 421/422/423. These were false positives in the sense that the imports are load-bearing (deleting them outright would leave REGISTRY.all() empty at runtime), but after change 2 they are genuinely redundant.

Verification

• ruff check clean on all affected files and packages.
• pyright clean on changed files (only pre-existing optional cursor-sdk missing-import note).
• Import smoke tests: plain import agent_tools now registers all 8 corpus.* tools; openai_harness, cursor_harness, dynamic_tools, and retrieval_server all import cleanly with a populated registry (no import-cycle introduced).