Bind MCP filesystem capabilities to the session workspace

[KimGLee]

What this fixes

The reported producer bug was one symptom of a missing transport authority boundary. All five fixed-output producers accepted arbitrary --output paths, while the MCP table was generated directly from argparse and did not say which tools belonged on the agent surface, which argument bound the corpus, or which arguments were filesystem capabilities.

That allowed MCP callers to reach detached/rootless modes, alternate in-repository namespaces, noncanonical receipt paths, and paths outside the governed corpus.

System-level change

• add a closed agent-interface-policy.yaml row for all 46 CLI tools and classify all 345 argparse arguments exactly once;
• compile exposure, workspace access, and typed read/write path capabilities into the CLI contract;
• project only the 40 corpus-runtime operations to MCP and keep six build/install producers CLI-only;
• enforce mandatory session-root equality plus canonical contained, exact, and namespace path envelopes, including effective argparse defaults;
• reject absolute typed paths, .., static symlink aliases, multiply-linked regular files, alternate exact artifacts, and invalid namespace suffixes before spawning a tool;
• pin an open workspace directory object through path inspection and child startup, so replacing or retargeting the configured root cannot transfer a session or in-flight call to another corpus;
• bind each of the five fixed producers to its one registered output on the CLI path as well;
• regenerate the CLI contract, MCP projection, host configurations, and metadata execution contract;
• update the README, Tool reference, Roadmap, and deterministic repository checks.

Boundary found during review

A separate process that already has concurrent write access to the adopter workspace can still replace an individual child path after transport inspection but before an existing tool reopens it. That is outside the current local trust-domain guarantee and cannot be closed by another pathname recheck. It requires a tool-wide stable path-object API or protected workspace execution and is tracked explicitly in #162; the documentation now states that boundary rather than claiming adversarial concurrent namespace isolation.

Verification

• make check
• git diff --check
• 284 focused contract, projection, MCP, path-policy, metadata, host-config, page-contract, and boundary tests: pass; 1 platform-specific skip
• independent read-only review reproduced and then verified closure of omitted defaults, registered symlink aliases, session-root replacement, and the root check-to-spawn race

Fixes #161.
Related #162.