Restrict _build_idf_env to safe env var allowlist (_SAFE_ENV_KEYS) instead of inheriting full os.environ. Add _resolve_project_path to confine Tier 2 tool paths within configured project_roots. Add 76 tests covering parsers, validators, subprocess runners, tools.json caching, and tool/resource/prompt registration.