fix tool storage, somehow, in isolation

[chee]

• the provider is not in the list of allowed providers
• also the tool storage gives the requester an automerge URL, keyed by a string, which is probably not what we want