feat: add read-only MCP observability

[ostapondo]

Summary

• expose get_agent_health, list_event_sources, get_incident_timeline, and get_local_metrics_summary through additive typed schemas
• add bounded read-only incident, ledger, health, and SQLite inspection paths
• extend Unix and Windows MCP Inspector validation and document the security boundary

MCP compatibility and safety

• preserves list_incidents and get_incident without renaming or removing fields
• all six tools declare read-only, non-destructive, closed-world annotations
• no repair, replay, rollback, approval, apply, arbitrary file, path, or shell tools
• observability outputs exclude raw artifacts, evidence, launch arguments, working directories, secrets, and model payloads
• health inspection never creates, rebuilds, quarantines, or writes the disposable index
• malformed fields, unknown arguments, non-UUID IDs, and traversal-shaped IDs are rejected

Validation

• cargo fmt --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• scripts/validate-mcp.sh with zero schema warnings
• privacy, exact-tool-allowlist, schema, malformed-input, traversal, bounded-read, and no-mutation tests

Windows MCP Inspector validation is wired into CI through scripts/validate-mcp.ps1.