fix(ai-red-teaming): normalize agent tool_calls in generated targets

[rdheekonda]

Summary

Generated agent targets (_build_agent_target_code and the ATLAS multi-agent
target builder) returned tool_calls verbatim. Agents that emit
{"tool": ..., "arguments": {dict}} (a common non-OpenAI shape) produced empty
name fields and dict arguments, so the SDK scorers' _extract_tool_calls
returned []. Result: any_tool_invoked, tool_selection_safety, and
dangerous_tool_args silently reported no tool use against agents that were
in fact calling execute_command / send_email on nearly every probe.

Found via a TUI coverage sweep across all 10 agentic attack categories: 10/10
ran end to end, but every trace showed tool_calls: [] despite confirmed RCE
and exfil.

Fix

• Emit a _normalize_tool_calls helper into the generated workflow script.
• Apply it in both agent-target builders so tool_calls is always
  [{name, arguments:str}], accepting the tool/args aliases and OpenAI
  nested function shape, and serializing dict arguments to JSON.
• Bump capability 1.17.0 -> 1.17.1 (published versions are immutable).

This pairs with the SDK-side hardening in dreadnode-tiger#2565 (scorer
_extract_tool_calls tolerance); normalizing at the target makes agentic
scoring correct regardless of the bundled SDK version.

Validation

• New TestAgentToolCallNormalization (3 tests) -> pass.
• Full test_attack_runner.py: 158 passed, 1 pre-existing unrelated failure
  (TestGenerateMultimodalAttack::test_generates_compiling_script_with_image,
  fails identically on clean main).