feat(settings): expose toolchain matching in the Feature Flags card

Adds toolchain_match_enabled to FEATURE_FLAGS so the panel's Settings ->
Feature Flags card can arm/disarm it (overriding the env default at the next
backend restart). The card is data-driven; only a one-line description blurb is
added. Validator, effective-value, and startup overlay auto-wire from the
tuple.

panel/src/components/settings/feature-flags-card.tsx

@@ -26,6 +26,8 @@ const FLAG_DESCRIPTIONS: Record<string, string> = {
   self_heal_originate_enabled:
     "Also open a PENDING fix task for a detected regression (needs Self-healing on; the task waits for your approval).",
   provisioning_enabled: "Auto-provision projects from approved pitches.",
+  toolchain_match_enabled:
+    "Provision each agent workspace with the target project's Python (not RoboCo's) and block delivery gates when its test suite can't be executed.",
   rag_auto_update_enabled: "Keep the knowledge base index refreshed automatically.",
   transcript_prune_enabled: "Run the background sweep that prunes old transcripts.",
 };

roboco/services/settings.py

@@ -51,6 +51,7 @@ FEATURE_FLAGS: tuple[tuple[str, str], ...] = (
     ("self_heal_enabled", "Self-healing (detect + notify)"),
     ("self_heal_originate_enabled", "Self-healing — open fix tasks"),
     ("provisioning_enabled", "Pitch auto-provisioning"),
+    ("toolchain_match_enabled", "Agent runtime toolchain matching"),
     ("rag_auto_update_enabled", "RAG auto-update"),
     ("transcript_prune_enabled", "Transcript pruning"),
 )