fix(mcp): Restructure pinned_path error builder to clear unused-variable analysis

[Xuepoo]

Summary

Fixes GitHub code-scanning alert #2 (CodeQL, rust/unused-variable) at crates/ctxctl/src/mcp.rs:459 — the key parameter of pinned_path was reported unused because the analyzer did not credit its capture into the inline-format escape closure.

Change

• escape now takes key, raw, and detail as explicit closure parameters instead of capturing them; all 4 call sites inside pinned_path pass key/raw explicitly. Format template unchanged.
• No behavior change; error strings are byte-identical.

Byte-identity verification (TDD)

Added characterization tests pinning the exact full error bytes for the reachable rejection branches:

• pinned_path_error_strings_are_byte_stable — pins absolute (invalid argument \file`: /etc/passwd: absolute paths are not allowed; path escapes workspace root) and traversal (invalid argument `file`: ../outside.txt: path escapes workspace root`) outputs verbatim; written red against placeholder strings first, then corrected.
• pinned_path_rejects_drive_relative_component (cfg(windows)) — pins the previously untested unsupported absolute-like component; branch.
  Existing fragment-pinning tests stay green unchanged: absolute_file_arg_is_rejected, traversal_file_arg_is_rejected, symlinked_escape_is_rejected (unit) and absolute_path_file_arg_is_rejected, traversal test in tests/mcp_test.rs. The symlink branch shares the same format template with only its unchanged literal detail differing, so pinned bytes cover it transitively.

Sweep

Scanned crates/ for other closures capturing-and-inlining-formatting outer variables. One same-class pattern remains at mcp.rs (require_str's ok_or_else(|| format!("missing or empty argument: {key}"))), but CodeQL does not flag it; left untouched per minimal scope. No other candidates found.

Gates

• cargo fmt --check — pass
• cargo clippy --all-features -- -D warnings — pass
• cargo test — all suites pass