Force a synchronous tunnel-tool re-aggregation and return the manifest.

The explicit refresh operation the dashboard (Settings → Tunnel Plugins status card) and any HTTP-capable connector can call instead of guessing at a TTL: it atomically invalidates the routing cache, re-fetches every healthy slot's tools, and returns the resulting :func:tunnel_manifest_snapshot — the same shape surfaced by GET /tunnel/status/{tenant_id} and the MCP tools/list _meta block, so a caller can diff manifest_hash against what it last saw.

No tunnel connected is not an error here — it returns a snapshot with has_active_tunnel: false and a null manifest_hash (nothing to aggregate), same as any other read of tunnel state.