fix: intrinsic function signatures

[jakelorocco]

1. Guardian intrinsics have function signatures that look like: factuality_correction(context: ChatContext, backend: AdapterMixin, ...). Notably, they do not include a document(s) field like the other intrinsics; they only grab documents from prior messages. We should move them to follow the conventions of the other intrinsics.
2. We should allow top-level intrinsic functions (like check_answerability and the guardian functions) to take model options now that Intrinsics support all model options (except streaming).

[akihikokuroda]

#935 will fix this issue.

[planetf1]

Heads-up that this work is now being picked up as part of epic #929 — the closed PR #1028 was the original implementation, but it overlapped enough with the in-flight adapter lifecycle redesign that we agreed to fold it in rather than keep it as a separate PR.

What's preserved from this issue:

• model_options= on all top-level intrinsic helpers — folded into Phase 1 of the Epic: Fix Intrinsic Adapter Lifecycle & Consistency in Mellea #929 plan (see §16 of the design proposal on PR docs: design proposal for adapter lifecycle (#929) — review channel, do not merge #1080).
• documents= keyword-only on factuality_detection / factuality_correction — same Phase 1 scope.
• Manual-Message document detection (scanning Message._docs in the conversation when documents=None) — carried forward as an explicit Phase 1 design call in §17 Q3 of the proposal so the work isn't lost.

Linking this issue as a child of #929 to make the relationship explicit. The proposal is currently open as Draft PR #1080 for review; once the gating decisions there are agreed, Phase 1 picks up #1003's concrete work.