The v5.x check command uses multi-line blocks per tool instead of single-line "tool version: found" format. Parser now tracks "Checking tool <name>" headings and "version installed in tools directory:" lines. Old single-line format still supported.
Restrict _build_idf_env to safe env var allowlist (_SAFE_ENV_KEYS) instead of inheriting full os.environ. Add _resolve_project_path to confine Tier 2 tool paths within configured project_roots. Add 76 tests covering parsers, validators, subprocess runners, tools.json caching, and tool/resource/prompt registration.
