Expose Maqam-scoped authorized context disclosure through local MCP

[AjnasNB]

Current state

The local stdio MCP surface shipped on main in #15 (merge commit e6fc3dca9e30fc7e243f2ca35a05e9ec8aa373fe) and exposes only bounded status and doctor diagnostics. It does not yet expose context query, context-pack compilation, raw event access, automatic prompt injection, or write tools.

Scope

Add separately declared, read-only context query and cited context-pack tools whose disclosures are explicitly workspace-authorized and can be routed through a registered Maqam policy/approval boundary. Keep diagnostics distinct from content disclosure.

Acceptance criteria

• Every disclosure binds an exact trusted workspace identity, tool name, canonical query/selection input, purpose/scope, audience/host, context budget, and ledger revision or checkpoint.
• The Maqam bridge registers the disclosure operation as a structural tool; policy denial, required-but-missing approval, altered input, stale revision, expired authorization, or invalid execution guard returns no context.
• Output is bounded, deterministic for an exact ledger state, evidence-linked, citation preserving, and reports exclusions/truncation.
• The server exposes no unrestricted raw event-dump, arbitrary file-read, secret lookup, hidden-reasoning, or cross-workspace query tool.
• Workspace trust and capture consent do not automatically grant disclosure; read scope is explicit and revocable.
• Status/doctor remain local metadata diagnostics and cannot be used to smuggle record content.
• Write/mutation tools, if proposed later, use separate names, schemas, effects, policies, approvals, and review.
• Protocol, cancellation, malformed-client, oversized-query, token-budget, concurrency, replay, and clean-install fixtures run offline on Node 22, 24, and 26.
• Codex, Claude, and generic MCP documentation states exactly which tools are installed, what is not automatic, and which calls bypass Maqam.

Boundaries

Do not claim MCP certification, automatic context injection into every agent, universal host compatibility, or governance of direct database/filesystem access outside registered adapters.