Fix research recipe GitHub pack requirements and direct-tool validation

[Trecek]

Research food trucks omit the github pack, hiding verify_review_receipt during review verification. Declare github in both research recipes and extend undeclared-pack-requirement to catch direct tools missing from a recipe's food-truck catalog, while preserving existing skill-category validation.

Regenerate compiled recipes, contract cards, and the research diagram hash; remove the four obsolete callability exemptions; update regression tests and authoring documentation. Empty-pack validation includes exploration tools to match the runtime's actual kitchen visibility. The warning-only validation fixture now declares kitchen-core for its headless test_check call.

Validation:

• pre-commit run --all-files passed.
• Contract freshness and compiled-recipe checks passed.
• Both research recipes have no undeclared-pack findings.
• Configured test_check / task test-local-gate passed: 18,931 passed, 420 skipped, 13 xfailed.

Fixes #5178.

Plan deviations and audit dispositions:

The plan treats KITCHEN_GATED_TOOLS as the complete empty-pack catalog, but the runtime branch enables kitchen, and exploration tool registration includes that tag. The original runtime test asserted inclusion of KITCHEN_GATED_TOOLS; it did not exclude exploration. The strengthened runtime regression proves that submit_exploration_query is visible and post_pr_review is hidden under empty packs. Existing recipe rule tests independently cover the corresponding validation outcomes. The union corrects validation without changing server visibility; broker authorization remains separate.

Finding	Disposition	Justification / correction
R-4: empty-pack predicate	justified deviation	With empty requires_packs, _apply_session_type_visibility enables the kitchen tag. submit_exploration_query is registered with both kitchen and exploration, so it is exposed by that branch. KITCHEN_GATED_TOOLS excludes exploration but is not the exact runtime catalog. Keeping the union prevents a false undeclared-pack error for a tool already visible at runtime. The validator does not change MCP visibility.
EXPLORATION_TOOLS import	justified deviation	The existing exported constant supplies the exploration portion of the real kitchen-tag surface. The import is required by the retained predicate and introduces no new registry or runtime visibility change.
_food_truck_can_call docstring	fixed	Restored the plan-prescribed reference to _apply_session_type_visibility and its explanation of non-empty packs versus the kitchen-tag fallback.
_check_undeclared_pack_requirement docstring	justified deviation	Retained the statement that the empty-pack kitchen surface includes exploration tools because it describes the actual runtime behavior. The rule still documents that only static pack visibility is checked; configuration, feature gating, and broker authorization remain separate.
R-11 / test #6	justified deviation	Both disputed tools remain covered, with separate tests for their different runtime outcomes: post_pr_review produces an ERROR under empty packs; submit_exploration_query produces no pack error. Parametrizing both as ERROR would encode the plan's incorrect runtime premise. The strengthened server visibility test independently proves the actual catalog exposes exploration and hides post_pr_review. Existing rule regressions assert the corresponding outcomes; replacing the union with KITCHEN_GATED_TOOLS alone would fail the exploration rule regression.
test_tools_recipe.py fixture alignment	retained; audit already accepts	The warning-only fixture calls headless-only test_check. Declaring kitchen-core makes that call visible under a non-empty allowlist, preserving the fixture's intended assertion that model-on-non-skill-step warnings do not invalidate the recipe. The first gate demonstrated the failure without this declaration.