Handle same-name re-registration during input serialization

[domfarolino]

Fix registerTool()'s duplicate tool name check, which can go stale during inputSchema serialization

registerTool() checks whether a tool with the same name already exists before serializing inputSchema. But serialization can run script (e.g., a toJSON() method), and that script can register another tool with the same name in the meantime. The algorithm would then go on to overwrite that tool's entry in the tool map.

This PR re-checks the tool map after serialization, right next to the "fully active" re-check added in #345, and rejects with an InvalidStateError, just like the up-front check.

Example:

document.modelContext.registerTool({
  name: 'same_name',
  description: 'Outer tool',
  inputSchema: {
    toJSON() {
      document.modelContext.registerTool(
          {name: 'same_name', description: 'Inner tool', execute() {}});
      return {};
    },
  },
  execute() {},
});  // Now rejects with an InvalidStateError; the inner tool stays registered.

See https://crrev.com/c/8583183 for WPTs.


<!--
    This comment and the below content is programmatically generated.
    You may add a comma-separated list of anchors you'd like a
    direct link to below (e.g. #idl-serializers, #idl-sequence):

    Don't remove this comment or modify anything below this line.
    If you don't want a preview generated for this pull request,
    just replace the whole of this comment's content by "no preview"
    and remove what's below.
-->
***
<a href="https://pr-preview.s3.amazonaws.com/webmachinelearning/webmcp/pull/347.html" title="Last updated on Oct 14, 2026, 10:54 PM UTC (5534fd4)">Preview</a> | <a href="https://pr-preview.s3.amazonaws.com/webmachinelearning/webmcp/347/1636b33...5534fd4.html" title="Last updated on Oct 14, 2026, 10:54 PM UTC (5534fd4)">Diff</a>