fix(mcp): annotate destructive command surface - #106

Closes #30

Records architecture decision §17: the single argv tool keeps the complete remote CLI surface, while discovery metadata pessimistically advertises the maximum risk of valid invocations.

Changes:

• replace the inaccurate universal “safe” description
• add explicit mutating/destructive/non-idempotent/open-world MCP annotations
• document the confirmation and security-boundary implications
• verify metadata plus deliberate stop and session close socket traversal end to end

Verification:

• pnpm test:runtime
• Swift 6.1 container: 40/40 protocol tests and MCP stdio integration
• full Linux Chromium E2E and artifact checksums