fix(providers): fail closed when Anthropic parse realloc fails

[cursor]

Summary

parse_response_body published text_cap / tool_cap before realloc succeeded. When grow failed, later memcpy and tool_calls[tool_count] still used the inflated cap against the live heap block.

Bug

• File/function: src/providers/anthropic.c (parse_response_body)
• Trigger: Anthropic/Claude content with a text block of 256+ bytes (or a 6th tool_use) while realloc fails (memory pressure, cgroup MemoryMax). Call chain: agent_run → provider router → anthropic_chat → do_request → parse_response_body.
• Impact: Heap overflow in the agent process (crash; potential memory corruption).
• Distinct from fix(gateway): wire provider and tools into POST /asap handler #53–fix(sandbox): keep agent workspace off gateway state files #79: those cover gateway/ASAP/sandbox/file/cron paths. No prior PR touches Anthropic parse growth.

Root cause

Capacity was doubled, then realloc could fail and leave the pointer on the old allocation. The text path still compared against the new cap and copied. The tool path continued after a failed grow, so the next tool_use skipped the grow check and wrote one slot past the array.

Fix

• Grow helpers update cap only after a successful realloc.
• Grow failure fails the parse, frees scratch state, and sets an OOM error instead of returning a corrupted response.

Validation

• CI=true make test_anthropic test_provider test_router
• GCC ASan/UBSan on test_anthropic (including forced-realloc-failure cases)