Add cds toolset: Copernicus Climate Data Store retrieval workflow

[yellowcap]

Ports the eight LangChain tools from the cds-assistant repo into this monorepo as a single toolset, deployed as one MCP service (mcp-cds).

What's included

toolsets/cds covers the full CDS retrieval workflow:

• Discovery — search_datasets (catalogue keyword search), get_dataset_schema (required parameters, valid values, types), apply_constraints (valid values given a partial request, e.g. to verify recent dates exist in the archive)
• Retrieval — submit_request, get_job_status, get_results (download link for completed jobs), list_jobs
• Auth — check_credentials

Tools call the CDS retrieve/catalogue APIs via a shared httpx client with exponential-backoff retry on transient failures (tenacity), and return structured error dicts (auth, licence, queue_limit, not_found, not_ready, bad_request, transient) so an agent can react appropriately — e.g. the licence error includes the dataset page URL where terms must be accepted.

Since the runtime only needs a cds.tools module exporting TOOLS, the original one-module-per-tool layout is preserved by making tools a package.

Changes from the source repo

• CDS_API_KEY is optional at import time so the server starts (and the contract test passes) without credentials; calls return structured auth errors until the key is provided.
• Settings trimmed to CDS-only config (no LLM settings — that's the consuming agent's concern).
• Unit tests ported with updated import paths, plus a TOOLS export test.

Configuration

• Local: CDS_API_KEY via env or .env, then TOOLSET=cds uv run mcp-serve.
• k8s: toolset.yaml lists a cds-credentials Secret (injected via envFrom), to be created out-of-band:

kubectl -n mcp-toolsets create secret generic cds-credentials \
  --from-literal=CDS_API_KEY=<personal-access-token>

Testing

• ./scripts/test — 60 passed (20 new, plus the contract test now covers cds)
• ./scripts/lint — ruff and mypy clean
• Smoke-tested locally: /health lists all eight tools and mcp-cli list shows correct schemas over streamable HTTP