fix: try_it_out tool not invoked — anti-hallucination rule blocking demo

Root cause: refactor to provider/data registry removed the try_it_out
rule from the system prompt. LLM received 'Run the try-it-out demo:
Runtime Health Audit', treated 'Runtime Health Audit' as an agent name
lookup, found nothing in DATA REGISTRY, and applied anti-hallucination
rule → refused instead of calling the tool.

Fixes:
1. chat.py system prompt: add explicit try_it_out rule — triggers on
   'template_id=', 'tryit', 'run demo' etc. Note that it creates its
   own demo agent, no pre-existing agent required.
2. chat.py anti-hallucination: add EXCEPTION for try_it_out, create_agent,
   create_plugin — these CREATE entities, DATA REGISTRY is irrelevant.
3. ChatWorkspace.tsx: /tryit slash command now sends
   'Run try-it-out demo template_id=runtime_audit' (slug, not human label)
   so the LLM cannot confuse the template name with an agent name.

src/api/routers/chat.py

@@ -531,6 +531,11 @@ def _build_system_prompt(
         "exist yet, reply: 'To save memories you need a memory agent first. "
         "I can create one for you — just say **create a memory agent**.'"
         " Then include [button:Create Memory Agent:/agents?spawn=1&skill=memory+agent].\n"
+        "- Use `try_it_out` when message contains 'try-it-out', 'tryit', '/tryit', 'run demo', "
+        "'show me demo', or 'template_id='. Pass the template_id exactly as given. "
+        "IMPORTANT: try_it_out creates its own demo agent automatically — it does NOT require "
+        "any pre-existing agent or plugin in DATA REGISTRY. Never refuse a try_it_out request "
+        "because of missing agents.\n"
         "- Answer in markdown for all other questions.\n\n"
         "Response formatting rules:\n"
         "- ALWAYS embed inline links when you mention any NebulaOS page or feature. "
@@ -554,6 +559,9 @@ def _build_system_prompt(
         "Anti-hallucination rules:\n"
         "- ONLY reference agents, plugins, models, and tasks listed in SYSTEM STATE below.\n"
         "- NEVER invent agent names, plugin names, or capabilities not in SYSTEM STATE.\n"
+        "- EXCEPTION: try_it_out, create_agent, and create_plugin all CREATE new entities — "
+        "they do NOT need pre-existing DATA REGISTRY entries. Never refuse these because "
+        "of empty DATA REGISTRY.\n"
         "- If asked about a capability that doesn't exist, say so clearly.\n"
         "- Do NOT claim web scraping, document parsing, PDF reading, or email/calendar access "
         "are available — these are not yet implemented.\n\n"

webapp/src/components/layout/ChatWorkspace.tsx

@@ -2224,8 +2224,8 @@ export function ChatWorkspace() {
         const templateArg = args.trim()
         const knownId = TRY_IT_TEMPLATES.find(t => t.id === templateArg || t.label.toLowerCase().includes(templateArg.toLowerCase()))
         const msg = knownId
-          ? `Run the try-it-out demo: ${knownId.label}`
-          : `Run a try-it-out demo: ${templateArg}`
+          ? `Run try-it-out demo template_id=${knownId.id}`
+          : `Run try-it-out demo template_id=${templateArg}`
         const sid = await ensureSession(msg).catch(() => undefined)
         nebulaMut.mutate({ message: msg, sid })
         return true