Let destructive be undeclared, so write tools aren't reported as non-destructive

destructive is a bool that defaults to FALSE. As a result, Tool API can't tell "not destructive" from "never declared".

mcp_server_tool_bridge sends the flag to MCP clients as destructiveHint. MCP defines destructiveHint: false as "the tool performs only additive updates", and defaults it to true.

So every write tool that doesn't set destructive: TRUE tells clients it only adds data, even if it overwrites or deletes.

That makes the default neither safe nor standard: MCP and mcp_server both treat an undeclared tool as destructive.

A possible solution is to make destructive a ?bool that defaults to NULL, meaning "not declared". The bridge would then send destructiveHint: true for NULL, which is MCP's default.

This would change the attributes and ToolDefinition::isDestructive(), so it needs to land before the RC1 freeze (#3582976).