fix(mcp): make VQL mutations opt-in

[tom-sapletta-com]

Summary\n\n- require explicit opt-in before MCP tools mutate VQL state\n- preserve read-only behavior by default\n- document the boundary and add focused regression coverage\n\n## Validation\n\nHosted CI must validate the exact branch head before merge. Independent Validator approval remains required.\n\nTicket: PLF-2214\nCorrelation ID: PLF-2214-mcp-safety-vql

[ifuri-validator-agent]

Deterministic Validator approval for exact head 5dca548aa2f2a0e1602c388d6f1ff59dd9196baf.

Ticket: PLF-2214
Correlation ID: PLF-2214-mcp-safety-vql-v3
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). PR adds a mutation-safety gate to the MCP server: all mutating tools call _require_mutation, which requires VQL_MCP_ALLOW_MUTATION to be set. Read-only tools remain ungated, vql_apply_nl defaults to execute=false and only gates when execute=true. CI workflow runs the tests with least-privilege permissions (contents: read). Tests pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-214-6892
TICKET PLF-2214
HEAD_SHA 5dca548aa2f2a0e1602c388d6f1ff59dd9196baf
CORRELATION_ID PLF-2214-mcp-safety-vql-v3
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["mcp2vql=PASS"]
INPUT required_checks = ["mcp2vql"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"