Add an MCP projection with CLI and SDK safety parity

[0thernet]

Outcome

Project eligible Wrench operations through an optional MCP server without creating a second execution or safety model.

The CLI and TypeScript SDK remain canonical. MCP should be a thin caller over the same validated operation registry, plans, confirmations, dispatch journal, recovery, and receipts.

Scope

• Generate MCP tool schemas from the same qualified operation descriptors used by the CLI and SDK.
• Expose only eligible operations whose schemas and authentication modes are compatible with the caller policy.
• Keep capture-required operations unavailable or explicitly inert.
• Preserve the two-step preview and confirmation flow for write operations; do not add a one-call mutation shortcut.
• Route every MCP invocation through the existing kernel-owned execution path.
• Keep plugin code unable to register arbitrary MCP tools or redefine risk and confirmation policy.
• Add transport-level cancellation, output bounds, redaction, and deterministic error mapping.

Acceptance criteria

• A fixture operation produces equivalent plans and receipts through CLI, SDK, and MCP.
• Killing or disconnecting the MCP caller cannot bypass unsettled-run recovery or corrupt durable state.
• Tool filtering is treated as ergonomics, not authorization; kernel validation still runs for every call.
• Conformance tests cover schema parity, identity binding, confirmation, drift, uncertainty, redaction, and cancellation.
• Public documentation makes the CLI/SDK authority and MCP projection boundary explicit.