Harden MCP execution sessions and add structured agent tools

[MaxBittker]

Summary

• serialize execute_code, perform_action, and scanning queries per bot, retaining the lock until already-started calls settle after cancellation or timeout
• transpile real TypeScript bodies, capture bounded request-scoped logs, bound all output, and preserve partial diagnostics plus terminal world state on failures
• health-check cached sessions and expose connection state, authentication, freshness, mode, controller/observer, and busy metadata
• add typed inspect_state, query_entities, and perform_action tools while retaining execute_code for advanced workflows
• track terminal messages with optional observation cursors so distinct same-tick publications are not suppressed
• exact-allowlist MCP resources, remove credential-prefix logging, keep stdout JSON-RPC safe, and document the trusted-code boundary

Why

Benchmark runs repeatedly lost output on timeout, continued mutating after tool cancellation, collided through concurrent calls, reused stale cached sessions, and failed on TypeScript syntax despite the tool claiming TypeScript support. This PR moves those guarantees into one tested execution/session layer.

inspect_state supersedes the older, narrower get_state proposal in #1.

Validation

• bun test mcp: 23 tests pass, 62 assertions
• bun x tsc --noEmit -p mcp/tsconfig.json
• bun sdk/test/chat-history.test.ts
• bun sdk/test/click-dialog-by-text.test.ts
• JSON-RPC stdio initialize/tools-list smoke test
• traversal attempt for /etc/passwd rejected
• git diff --check

Known boundaries

• Public SDK methods do not yet accept AbortSignal. An already-started call cannot be forcibly stopped, so the queue stays locked until it settles; a never-settling promise requires disconnect or process restart.
• CPU-bound synchronous code cannot be pre-empted on the Bun event loop.
• Serialization is per MCP process, not across unrelated controllers.
• execute_code remains trusted, unsandboxed execution and transpiles rather than type-checks TypeScript.
• perform_action intentionally exposes the common validated high-level subset, not every BotActions method.
• No live game bot was used in validation.

Root tsc retains the two pre-existing banking nullability errors; PR #43 fixes those and adds repository-wide CI.

[MaxBittker]

Superseded by the deliberately minimal #47, which keeps only per-bot execute_code FIFO/quiescence, scoped TypeScript/log execution, and CI coverage.