feat: add live-model validation for MCP tool gating

[rlippmann]

Summary

Adds an opt-in Tier 3 live-model validation path for the Python MCP tool-gating example.

The existing provider-free tests remain the canonical enforcement proof. This change adds a live-model path demonstrating that a real model can only act through the tool surface exposed by the host from authoritative Context Compiler state.

Changes

• Added live-model validation support for:
  • python/examples/tool_gating/mcp_calendar_admin
• Added provider-free coverage for live-model provider configuration and request construction.
• Added a shared example helper:
  • python/examples/_shared/litellm_request.py
• Reused the shared helper from:
  • MCP calendar-admin live-model validation
  • expense-approval live-model validation
• Adopted LiteLLM’s built-in compatibility handling via drop_params=True rather than maintaining GPT-5-specific parameter filtering.
• Preserved Ollama model normalization for LiteLLM compatibility.
• Updated MCP tool-gating documentation.

Why

This adds a runtime validation layer above the existing provider-free tests.

The live-model path demonstrates:

• authoritative Context Compiler state controls the model-visible tool surface
• the same intent produces different outcomes when authoritative state changes
• protected execution remains host-controlled
• model output does not grant authority

Validation

Provider-free

• ./scripts/validate_python.sh
  • Result: passed
  • 167 passed, 6 skipped

Focused tests

• uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model_provider.py -v
  • Result: 7 passed

Live-model validation

Ollama

RUN_MCP_CALENDAR_ADMIN_LIVE_MODEL=1
PROVIDER=ollama
MODEL=qwen2.5:1.5b-instruct
uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model.py -v

Result:

• 1 passed

OpenAI

RUN_MCP_CALENDAR_ADMIN_LIVE_MODEL=1
MODEL=openai/gpt-4o-mini
uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model.py -v

Result:

• passed

RUN_MCP_CALENDAR_ADMIN_LIVE_MODEL=1
MODEL=openai/gpt-5-mini
uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model.py -v

Result:

• passed

RUN_MCP_CALENDAR_ADMIN_LIVE_MODEL=1
MODEL=openai/gpt-5
uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model.py -v

Result:

• passed

RUN_MCP_CALENDAR_ADMIN_LIVE_MODEL=1
MODEL=openai/gpt-5.4
uv run --no-sync pytest python/tests/test_mcp_calendar_admin_live_model.py -v

Result:

• passed