Add opt-in trust for local ICM MCP tools

[Lauritz-Timm]

Summary

Add explicit opt-in trust configuration for ICM's core MCP recall and store tools.

Motivation

Local ICM calls have been denied in Codex and Claude Code, and the same client-side approval boundary exists in Cursor, OpenCode, and Zed. MCP annotations are advisory; a local stdio server cannot grant itself trust.

Changes

• add icm init --mode mcp --trust-local-mcp
• configure only icm_memory_recall and icm_memory_store
• define every supported client's location, format, and trust rules in one source-controlled provider registry shared by discovery, init, uninstall, and tests
• support Codex CLI per-tool approval modes
• support Claude Code user permission rules
• support Cursor IDE mcpAllowlist entries
• support OpenCode 1.x per-tool permission entries
• support Zed per-tool MCP permission defaults
• preserve unrelated settings and existing deny or confirm rules
• make init idempotent
• make uninstall detect and remove only rules added by ICM
• upgrade the install manifest to schema 2, record the exact changes owned by ICM, and persist that provenance immediately after each client configuration write for crash-safe cleanup
• reconcile stale provenance after confirmed uninstall while retaining ownership information when a configuration cannot be parsed safely

Compatibility and safety

The default init path is unchanged. There is no server-wide wildcard, unrestricted mode, or MCP protocol change. Store may trigger configured consolidation, and recall updates access and decay metadata, so the flag is explicit and neither tool is described as read-only. Managed policies and separate safety checks may still reject calls.

Provider specifications are source-controlled rather than arbitrary user configuration because they define which client settings ICM is allowed to trust and later remove. Schema-1 manifests remain readable; schema 2 adds precise ownership so cleanup does not remove pre-existing user rules.

Validation

cargo test -p icm-cli --locked --offline \
  --no-default-features --features backend-sqlite,embeddings-dynamic
cargo clippy -p icm-cli --bin icm --tests --locked --offline \
  --no-default-features --features backend-sqlite,embeddings-dynamic -- -D warnings
cargo fmt --all -- --check

The final suite passed 374 unit tests and 17 integration tests, with 2 tests ignored. Focused provider tests exercise every registry entry through discovery, installation, exact-change recording, schema-2 save and reload, interrupted multi-client installation, ownership-aware uninstall, and reconciliation without duplicating provider-specific expectations.

Manual verification:

icm init --mode mcp --trust-local-mcp
icm uninstall --dry-run

Inspect the detected clients' configuration files and verify that only recall and store were added.