Enforce stable path capabilities through tool consumption

[KimGLee]

Closes #162

Root cause

The MCP boundary validated caller-supplied paths before dispatch, but production tools reopened those path strings later. That separated admission from consumption: namespace/path identity could change between the two points, nested subprocesses could lose the admitted object, and a server-side return could be acknowledged without proving the exact semantic argument was consumed.

Structural fix

• define a closed public path contract with typed snapshot, append, replace, and transaction consumption modes plus explicit activation predicates
• compile and project that contract into the public CLI/MCP interface
• retain descriptors across dispatch and nested Cambium subprocesses, and consume through a shared capability layer instead of reopening unchecked path strings
• require exact capability acknowledgements; reject ambiguous semantic aliases before execution
• fail closed on identity drift, missing descriptor propagation, inactive/invalid arguments, and unsupported no-follow platforms
• add a module-boundary guard so future production tools cannot bypass the shared subprocess carrier
• document the guarantee precisely as caller-visible active typed paths, not whole-workspace isolation

This is a public Cambium contract and reference implementation. It contains no Atlas-specific compatibility or migration behavior; downstream profiles remain responsible for adopting the public interface.

Verification

• full test suite: 1,873 tests passed, 1 skipped
• make check
• module-boundary suite: 17 tests passed
• compiler/projection/MCP focused suite: 160 tests passed
• nested subprocess affected suite: 222 tests passed
• git diff --check
• two independent read-only boundary reviews: PASS