The streaming content gate only ran when the request carried a tools array. But
the AISBF relay can drop tools (as it does max_tokens), so a gemma model still
emitting <|tool_call>call:NAME{…} from its system prompt had that markup streamed
straight to the client as content — the spill that poisoned history and fed the
tool-call loop.

_gate_tool_content now:
  * ALWAYS withholds the unambiguous native special-token markers (<|tool_call>,
    <|tool_response>, DeepSeek DSML) and their cross-chunk partials, even with no
    tools declared;
  * gates the ambiguous <tool>…</tool> XML form only when tools are present;
  * gates the gemma-4 call:NAME{…} form by the per-model gemma_tool_parser mode
    (off: never; full: always; restricted: only declared tool names), so legit
    call:foo{…} prose/code is streamed instead of withheld+dropped.
The gate is now invoked for every stream (not just tools-present), and the final
flush likewise, with the mode/tool context resolved once per request.

Bump version to 0.1.2.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RdMufYvtTbtGDWsiZVoXce