fix(acl): allow Honey to reach MCP proxies (TIN-2940)

[Jesssullivan]

Why

The pooled MCP canary runs on Honey. Tailscale proxy logs show Honey-to-MCP TCP/8080 dropped with no rules matched. The existing tag:k8s identity covers the broader Kubernetes fleet and is too wide for this exception.

Change

• define a dedicated tag:mcp-proxy identity owned by tag:k8s-operator
• grant only the named tinyland-honey host to tag:mcp-proxy on tcp:8080
• add semantic policy tests for ownership, exact TCP scope, and absence of the rejected broad tag:k8s rule
• run those tests in CI

Deployment ordering

1. Land/apply this policy source so the operator may assign tag:mcp-proxy.
2. Land the Blahaj service annotations that preserve tag:k8s and add tag:mcp-proxy.
3. During an attended window, recreate the five existing Tailscale-exposed Services; Tailscale does not retag an existing Service solely from an annotation update.
4. Verify proxy tags, Honey connectivity, and the lab MCP canary.

No Service recreation, workload deployment, or local ACL push is part of this PR.

Evidence

• live tailscale ping Honey -> mcp-fetch-2 succeeds
• live proxy log records the ACL drop on TCP/8080
• semantic policy tests cover the dedicated identity and TCP-only grant
• signed commit verified
• repository CI performs Dhall type/build, contract tests, and live-policy diff

Linear: TIN-2940

[github-actions]

⚠️ ACL Validation

Validation

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Loading local policy from /home/runner/work/tailnet-acl/tailnet-acl/generated/policy.json ...
Fetching live ACL from taila4c78d.ts.net ...

Validation FAILED: local policy differs from live.
acls: OK
autoApprovers: OK
grants: MISMATCH
  count: live=8, local=9
  [7] DIFFERS:
    live:  {"src":["tag:dollhouse"],"dst":["tag:dollhouse"],"app":{"tailscale.com/cap/relay":[{}]}}
    local: {"src":["tinyland-honey"],"dst":["tag:mcp-proxy"],"ip":["tcp:8080"]}
  [8] ONLY IN LOCAL: {"src":["tag:dollhouse"],"dst":["tag:dollhouse"],"app":{"tailscale.com/cap/relay":[{}]}}
groups: OK
hosts: OK
nodeAttrs: OK
ssh: OK
tagOwners: MISMATCH
  key 'tag:mcp-proxy': ONLY IN LOCAL

Diff against live

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Fetching live ACL ...

Changes to apply:
  ~ grants: 8 -> 9 (+1)
  ~ tagOwners: changed

(dry run, no changes made)