feat(mcp): wire tool discovery to spec.safety via meta.mcp_flags

[leo-aa88]

Summary

PR #124 introduced spec.SafetyFromMCPMeta and spec.MergeToolSafety for mapping MCP tool descriptor metadata onto spec.safety, but no production path calls them yet. Author-set spec.safety in YAML is the only source of truth today.

This issue tracks wiring MCP tool discovery / registry merge so server-provided flags populate tool safety with correct precedence.

Motivation

Issue #103 defined precedence:

explicit Policy rule  >  spec.safety (author-set)  >  MCP meta.mcp_flags  >  fail-closed default

Without discovery wiring, MCP tools always fall through to fail-closed defaults unless authors duplicate flags in YAML.

Scope

In scope

• When MCP tools are listed/discovered (stdio or HTTP transport), read meta.mcp_flags.{trusted,side_effects,requires_approval} and map via spec.SafetyFromMCPMeta.
• Merge with author spec.safety using spec.MergeToolSafety (author wins per field when set).
• Run merge before or as part of NormalizeProjectGraph / graph load so validate, plan, and run see effective safety.
• Unit/integration tests: MCP meta only, author overrides MCP, missing meta → fail-closed.

Out of scope

• Changing the feat(spec,policy): tool safety metadata + fail-closed policy derivation #103 derivation truth table or policy evaluator precedence.
• Interactive HITL approve/reject UX.

Acceptance criteria

• MCP-discovered tools without author spec.safety inherit flags from meta.mcp_flags when present.
• Author spec.safety fields override MCP for the same field; unset author fields can fall back to MCP.
• Documented in CHANGELOG when shipped; remove or update the “Not yet wired” note in CHANGELOG.md.
• Tests cover merge precedence and at least one MCP transport path (mock server acceptable).

References

• Parent: feat(spec,policy): tool safety metadata + fail-closed policy derivation #103 (tool safety metadata + fail-closed policy derivation)
• Landed helpers: PR feat(spec,policy): tool safety metadata + fail-closed policy derivation #124 — internal/spec/safety.go (MCPMetaFlagsKey, SafetyFromMCPMeta, MergeToolSafety)
• Design precedence: feat(spec,policy): tool safety metadata + fail-closed policy derivation #103 reference design (WayFind-aligned)

Notes

Discovery hook point may be internal/tools/mcp and/or project loader / registry — confirm where tool descriptors are first merged into ProjectGraph.Tools before implementing.