fix(mcp): gate SUMD writes and contain event files

[tom-sapletta-com]

Summary\n\n- require explicit authorization for SUMD MCP writes\n- confine event-store paths to the configured boundary\n- add focused path-containment and mutation-gate regressions\n\n## Validation\n\nHosted CI must validate the exact branch head before merge. Independent Validator approval remains required.\n\nTicket: PLF-2215\nCorrelation ID: PLF-2215-mcp-safety-sumd

[ifuri-validator-agent]

Deterministic Validator approval for exact head 30482cd525b8816f3d07ee1822a98725660d0897.

Ticket: PLF-2215
Correlation ID: PLF-2215-mcp-safety-sumd-v2
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Security-hardening PR: MCP write/command/DSL mutation tools are gated behind SUMD_MCP_ALLOW_MUTATION (default off), event-store filenames now use SHA-256 hashed aggregate IDs preventing path traversal, CI updated to pytest and CLI verification, mcp dependency upper-bounded below 2.0. Tests added for mutation gating and path containment. Only test result: quality PASS.
Advisory findings: Positive: path traversal via aggregate_id ('../escaped') fixed by hashing filenames; MCP file writes and event mutations now require explicit SUMD_MCP_ALLOW_MUTATION opt-in, reducing risk of untrusted MCP clients writing files. No residual vulnerabilities identified in this chunk.
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-215-8087
TICKET PLF-2215
HEAD_SHA 30482cd525b8816f3d07ee1822a98725660d0897
CORRELATION_ID PLF-2215-mcp-safety-sumd-v2
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["quality=PASS"]
INPUT required_checks = ["quality"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"