fix: register menu_tool and upload_tool, and return structured results from select_option

[FritzHeider]

Problem

menu_tool and upload_tool are defined in src/agent/tools/service.py and imported in src/agent/tools/__init__.py, but neither is listed in BUILTIN_TOOLS. The agent is never offered them, so they are effectively dead code — there is currently no way for the agent to select an option in a <select> dropdown.

Registering them surfaced a second problem: select_option returned a bare true/false that nothing consumed, so every failure looked identical to success. menu_tool would report "Selected X" even when the option didn't exist, when the element wasn't a <select>, or when the XPath resolved to nothing — leaving the agent to continue on a page that never changed.

Changes

• Register menu_tool and upload_tool in BUILTIN_TOOLS.
• Browser.select_option / Page.select_option_at now return a structured dict — {selected, notFound, available} on success, or {error: 'not_found'} / {error: 'not_select', tag} — instead of a silent boolean. available is capped at 30 options.
• menu_tool raises on each failure shape, and includes the dropdown's actual options when a label doesn't match, so the agent can retry with a real value rather than guessing. This matters in practice for near-miss text — a typographic apostrophe vs. an ASCII one, for instance.
• Selection now sets selectedIndex for single-select (the previous loop set .selected on options, which misbehaves on single-select) and fires input before change, which several frameworks need to register the update.
• Labels are embedded with json.dumps rather than string-concatenated, so labels containing quotes no longer break the injected script.

Tests

Adds tests/test_menu_tool.py — 9 tests covering registration, the structured result shapes, each menu_tool error path, and the select_option_at parity. They stub execute_script, so no browser is required.

Merges cleanly onto current main.