Add guarded MCP policy gateway slice

[rishvaiyer]

What changed

• Added a stateless HTTP MCP endpoint at POST /mcp.
• Implemented MCP initialize, ping, tools/list, tools/call, and initialized notifications for protocol 2025-06-18.
• Added one synthetic weather.get_forecast tool routed through capability, scope, content, nonce, and receipt checks.
• Added Origin and protocol-header checks, with denied calls returned as quarantined MCP tool results.
• Updated the README and iteration log with UI examples, API usage, proof counts, and explicit production limits.
• Included the existing penTell entry and gate UI repairs in the same release.

Why

This makes the MCP direction executable locally while keeping the security boundary honest. The demo never connects an external tool or credential. Allowed calls stop at would-forward-to-tool; denied calls never cross the forwarding boundary.

Verification

• npm test: 171/171 passing
• npm run lint: passing
• git diff --check: passing
• Local HTTP smoke: initialize, tools/list, allowed call, prompt-injection quarantine, initialized notification, and unexpected-Origin rejection

Next boundary

Upstream MCP forwarding, stateful sessions, streaming or stdio transport, durable approval identity, and a browser companion remain separate follow-on work.