Add MCP tool annotations with legacy protocol support

[Lauritz-Timm]

Summary

Add accurate MCP behavior annotations while preserving the legacy tools/list response.

Motivation

Local ICM calls have been denied in Codex and Claude Code. Local stdio does not establish trust, but annotations let clients distinguish side effects, destructive behavior, idempotency, and external access instead of relying on conservative defaults.

Changes

• annotate every ICM tool
• centralize each tool's name, input definition, behavior, availability, optional typed output schema, and handler adapter in one cached ToolSpec registry
• dispatch tool calls through that same registry so adding a tool requires one registration
• describe icm_memory_recall as mutating because it applies decay and updates access counters
• keep icm_learn open-world because it reads a caller-selected directory
• mark database-only operations closed-world where appropriate
• distinguish destructive, idempotent, and additive writes
• expose annotations only to protocol revisions that support them
• verify recall's access-counter side effect

Compatibility and safety

MCP 2024-11-05 clients receive the exact existing tools/list shape. Newer clients receive advisory metadata only; authorization remains client-side.

Validation

cargo test -p icm-mcp --locked --offline server::tests
cargo test -p icm-mcp --locked --offline tools::tests::tool_definitions_are_annotated_without_changing_legacy_shape -- --exact
cargo test -p icm-mcp --locked --offline tools::tests::test_store_and_recall_roundtrip -- --exact
cargo clippy -p icm-mcp --all-targets --locked --offline -- -D warnings
cargo fmt --all -- --check

Focused registry tests verify unique names, catalog-owned dispatch, the legacy definition shape, and the behavior annotations for every registered tool.