fix(toolbox-core): load_toolset(strict=True) rejects fully used auth tokens and bound params #734

Summary

ToolboxClient.load_toolset(..., strict=True) incorrectly fails when every provided bound parameter / auth token is used by every loaded tool. The documented success path is unreachable whenever any auth getters or bound params are supplied.

Affected Area

• packages/toolbox-core/src/toolbox_core/client.py (ToolboxClient.load_toolset)
• Sync wrapper inherits the bug via ToolboxSyncClient.load_toolset

Repro

# Mocked transport returning a single tool that declares param_P.
await client.load_toolset(
    bound_params={"param_P": "some_value"},
    strict=True,
)

Actual

ValueError: Validation failed for toolset 'default': unused bound parameters could not be applied to any tool: param_P.

Expected

Per the strict docstring: raise only when any loaded tool fails to utilize all provided parameters/tokens. When every tool uses them, loading should succeed.

Root cause

In the per-tool loop, overall_used_auth_keys / overall_used_bound_params are updated only in the else (non-strict) branch. The final toolset-level validate_unused_requirements(...) always runs afterward with empty overall-used sets under strict=True, so every provided key looks unused.

Why this matters

Callers who enable strict=True to enforce per-tool completeness of shared bound params / auth tokens cannot successfully load an otherwise valid toolset.