#912 Tool registry swallows ImportError: a broken tool module silently drops tools (126 -> 124) with only a log warning

EARS SPEC: - When a tool module fails to import, the tool registry shall fail loudly (or expose the degradation through a health check), NOT silently register fewer tools. - The number and names of registered tools shall be an asserted invariant, not an emergent property of which imports happened to succeed. FOUND DURING #895 (split of enterprise/tools/secrets.py, epic #854). DEFECT: enterprise/tools/registry.py wraps tool-module imports in `except Exception` and only calls logger.warning. So an ImportError in a tool module does not fail startup - it silently drops that module's tools from the registry. For the secrets module that is 126 -> 124 tools (tools.secrets.get, tools.secrets.set), with nothing but a warning in the log. WHY THIS IS SERIOUS: a workflow referencing a dropped tool fails at EXECUTION time with an unknown tool error, long after deploy, and the deploy itself looks clean. The operator sees a workflow failure, not an import failure. This is the same class of silent degradation as #850 (a renamed CLI console script hidden by `|| true`) and #852 (breaker state written to a database nobody reads). WHY IT MATTERED HERE: during the #854 file-size refactor the tool registry was used as a regression oracle. Comparing only the tool COUNT would have been weak; a swallowed import shows up as a smaller count with no error. The refactor compared the full sorted list of 126 tool NAMES before and after for exactly this reason, and it stayed identical throughout - so no tool was actually lost. But the oracle only worked because it was name-level. SUGGESTED FIX (needs a decision): (a) let the ImportError propagate and fail startup - safest, matches the #850 precedent of removing `|| true`; or (b) keep booting but record the failure and surface it in /api/v1/health, so a degraded registry is visible to a probe rather than buried in a log line. Either way, add an assertion of the expected tool-name set so a silent drop cannot pass unnoticed. VERIFY (both directions - do not just check it boots): - known-positive: break one tool module's import deliberately and confirm the chosen behaviour triggers (startup fails, or health reports degraded). - known-negative: restore it and confirm all 126 tool names are present. A check that has only ever seen a healthy registry cannot prove it would notice an unhealthy one.