feat(mcp): scope servers and tools by runtime context

[pengpengyi92]

Summary

• add optional organizations, projects, and roles scopes to each MCP server config
• skip out-of-scope servers before connecting, so unrelated runtimes do not start the server or touch its credentials
• filter role-scoped tools before schema exposure and enforce the same scope again at dispatch time
• preserve existing global behavior when scope lists are empty; support * as a wildcard
• document the configuration and fail-closed role behavior

Security boundary

Role authorization comes from a runtime-owned task attribute set by NativeAgent, not model-authored tool arguments or task metadata. A scoped tool with no trusted runtime role is denied. Organization and project checks happen before the MCP connection is created.

This intentionally does not add per-tool policy beyond the existing tools_filter; the server scope and allowlist compose without changing current configurations.

Validation

• 19 passed: MCP scope tests + task-mode contract tests
• 21 passed, 2 deselected: affected native tool stack tests; two Windows secure-workspace cases were excluded because this platform cannot enforce the repository's POSIX workspace primitives
• new test file passes Ruff
• compileall passes
• git diff --check passes

Closes #42