fix(security): don't let manage_settings re-enable disabled tools

The refactored disable_tool branch iterates targets and appends only tools not already in current. If the caller passes a tool that is already disabled, the loop does nothing for that tool, changed will be empty, and the response says 'Disabled tool_name (...). Now disabled: ...' with no indication that the tool was already disabled. This is a behavior change from the old code, which also did not detect duplicates, but the new code removes the enable_tool path entirely, making the duplicate-silence the only path. If the agent or a user expects feedback on whether a tool was already disabled, this could be confusing. The PR description does not mention this change in semantics.