feat: add MCP server adapter

[jmgilman]

Summary

• expose exactly search_api, describe_api, and execute through the official MCP Go SDK
• resolve trusted subjects before service work and project stable coarse tool errors
• prove the secure loop through an actual in-memory MCP client/server transport
• document the CodeMode MCP boundary

Verification

• go test ./mcpserver -run '^TestActualMCPSecureLoop$' -count=1
• go test ./mcpserver/... -count=1
• go test -race ./... -count=1
• moon run root:lint
• go build ./...
• moon run docs:build
• git diff --check
• independent code review: PASS
• implementation-plan conformance review: PASS