feat: add public access level for anonymous-safe chat tools

[chubes4]

Summary

Adds a first-class public access level to Data Machine's tool policy resolver.

This is the generic primitive needed for public-facing assistant experiences where anonymous users can access a small set of explicitly safe read-only tools.

What changed

• Added public to ToolPolicyResolver::ACCESS_LEVELS
• checkAccessLevel( 'public' ) now always returns true
• Updated BaseTool docs to include public
• Added tests proving:
  • anonymous users can receive tools explicitly marked access_level => 'public'
  • untagged tools remain admin-only for anonymous users

Important constraints

• No existing tool is made public in this PR
• Ability-linked tools still defer to their permission callbacks
• Untagged tools still default to admin (safe fallback)
• This adds the primitive, not the product rollout

Why this matters

Roadie and future Data Machine consumers need a clean distinction between:

• public — anonymous-safe tools
• authenticated — logged-in user tools
• author / editor / admin — increasingly privileged tools

This keeps Data Machine generic while enabling products like Roadie to expose safe public capabilities intentionally.

Validation

• modified files pass PHP syntax checks
• homeboy test data-machine still shows broad pre-existing repo failures unrelated to this change