Remove the file-upload workspace feature; keep namespace discovery

[tae2089]

What

Removes the namespace file-upload workspace — a generic base64 blob store (upload/list/delete files under a server root). It was a redundant ingestion path next to local ccg build and the webhook clone/pull pipeline, and off the project's purpose (annotation + graph + search for code context). Namespace discovery is kept and improved.

Changes

• Delete internal/namespacefs (~500 LOC of upload/list/delete/write machinery).
• Remove 5 MCP tools: upload_file, upload_files, list_files, delete_file, delete_namespace.
• Rework list_namespaces to be graph-backed: distinct namespaces with per-namespace node counts, paginated, cross-namespace — so callers can discover and scope searches to other namespaces. Moved to the query tool group.
• Relocate the namespace path-safety helpers into internal/mcp/namespace_paths.go (still used by RAG doc reads), rewired onto pathutil.ValidateNamespacePath + safepath.EnsureNoSymlinkInPath. Validation logic unchanged.
• Move the namespace path validator to internal/pathutil; wikiserver uses it.
• Sweep docs, skills, AGENTS.md, and the integration script (drop the upload phases; the MCP build phase relied on upload and is covered by the webhook clone→build pipeline).

Net −2235 lines. MCP tools 26 → 21 (this branch is off main; independent of the pending analyzer/postprocess trim PRs).

Design note (codebase-design)

namespacefs was a shallow 500-line module serving a single caller. Only its path-name validator had another user (wikiserver). Deleted the package; relocated the validator to pathutil (correct locality for path/name safety), dropping no checks.

Review

Independent adversarial review (path-traversal/symlink parity, DB-listing correctness, dangling refs): no P0/P1/P2. The relocated validator and resolver are byte-for-byte equivalent to the originals (same ContainsAny set, same Abs→MkdirAll→EvalSymlinks root resolution, same symlink guard). One P3 (empty-DB null vs []) fixed.

Verification

• go build + go vet clean; go test -tags fts5 ./... green; bash -n on the integration script clean.
• Real MCP server (streamable-http): tools/list returns 21 tools; the 5 upload/delete tools absent; list_namespaces present and DB-backed — with two seeded namespaces it returns [{alpha, node_count:2}, {beta, node_count:2}].

🤖 Generated with Claude Code