docs: reconcile rulebook with the 102-rule pack and index the mcp family

[jhumel-code]

Catches the rulebook up to the current 102-rule pack (which now includes the 14-rule mcp/ pack) on every axis: the generated indexes, the totals, and the per-rule rationale docs. CI is green.

Commit 1 — index the mcp family + fix stale totals

• tools/gen_index.py — added the mcp family to SDK_ORDER / SDK_LABEL / SDK_FULL. Without it the generator omitted all MCP rules from the index.
• POLICY_INDEX.md (master + per-SDK) + new mcp/POLICY_INDEX.md — regenerated from the pack. gen_index.py --check now passes (102 rules); it was failing on 4 stale index files.
• README.md — the "Current totals" table was badly stale (~43 rules). Reconciled to the real counts.
• docs/policy-rationale-doc-template-guide.md — fixed broken example paths in the guide.

Commit 2 — rationale docs for all 14 MCP rules

The consistency gate (check_rulebook.py --strict) requires a rationale doc for every shipped rule; the mcp/ pack had none, so CI was red on 14 coverage errors. Added docs/Policy/mcp/{tool_definition,network,path_safety,error_handling,idempotency,ssrf,code_execution,shell_safety}.md (8 docs covering MCP-001..014).

• Each is modeled on the existing same-topic doc in the claude_sdk / openai_sdk / google_adk chapters, so the OWASP references, fix_type, and threat-model structure are grounded in already-reviewed precedent rather than invented.
• Front-matter severity/confidence/scope is copied verbatim from the pack (the gate checks to 1e-9).
• The prose is grounded in the actual rule predicates read from the engine (has_code_exec_call, code_exec fact in ts_handler_facts.go, the HTTP-callee sets in heuristics.go/ts_handler_facts.go), including the MCP-specific trust-boundary framing (model-controlled inputs from an external orchestrator, no human in the loop, server shared across clients).

Result

• check_rulebook.py --strict → OK (102 rules, 45 docs, 0 errors).
• gen_index.py --check → OK (102 rules).
• Build-PDF job → green.
• This closes the standing rulebook coverage gap — every shipped rule now has a rationale doc.

Reviewer notes

• Includes a 3-line change to tools/gen_index.py (the index generator); the regenerated POLICY_INDEX.md files are its output.
• The indexes were regenerated in a Python 3.12 env to match CI (the gen_index.py write path needs 3.10+; the machine default is 3.9 — a latent tooling nit, noted but not fixed here).