feat(mcp): brain_read + brain_edit, contained to the sync source (brain#4) (#96)

brain_read returns a note verbatim; brain_edit is str_replace with an
exactly-once match, operating on the tree brain-sync commits from.

An adversarial design review before implementation changed three things:

1. Governance files are not in the model-facing tool. Brain content is
   ingested from the outside world and reaches a model's context, and that
   model would hold the editor — one poisoned page could rewrite the
   CLAUDE.md a .dispatch-allow agent later loads as instructions. And
   brain-sync merges with --strategy-option=ours, so the live tree beats a
   human's corrective push on the conflicting lines. CLAUDE.md now goes
   through brain_edit_root: de-surfaced from tools/list and gated on the
   local static principal. The scopes are disjoint — the privileged door
   has the smaller reach.

2. Reads needed the same allowlist, and brain_get already lacked it: it
   returned verbatim session transcripts under archive/ by path. A test
   proved the exposure live before the fix.

3. Canonicalise before allowlisting — knowledge/../.git/hooks/post-commit
   would otherwise reach a hook that brain-sync executes in a pod holding
   the Gitea push credentials.

Plus overlapping match counting, UTF-8 validation both ways, refusal while
git is mid-operation, flock with the read inside the lock, atomic
same-dir rename, and reindex only when frontmatter is touched.

Refs brain#4.

Co-authored-by: Mathias <mthbqv@gmail.com>

ingestion/internal/mcp/tools_capture.go

@@ -31,7 +31,7 @@ func captureToolDescriptor() map[string]any {
 		"type": "object",
 		"properties": map[string]any{
 			"text": str("the insight body"), "wing": str("brain wing"),
-			"hall": str("brain hall (facts/decisions/failures/hypotheses/sources)"),
+			"hall":           str("brain hall (facts/decisions/failures/hypotheses/sources)"),
 			"supersede_slug": str("optional: slug of a prior note to revise in place instead of creating"),
 		},
 		"required": []string{"text", "wing", "hall"},
@@ -41,7 +41,7 @@ func captureToolDescriptor() map[string]any {
 		"properties": map[string]any{
 			"repo": str("gitea repo (owner is always mathias)"), "action": str("create|close|comment"),
 			"number": map[string]any{"type": "integer", "description": "issue number (close/comment)"},
-			"title": str("issue title (create)"), "body": str("issue/comment body"),
+			"title":  str("issue title (create)"), "body": str("issue/comment body"),
 		},
 		"required": []string{"repo", "action"},
 	}
@@ -51,14 +51,14 @@ func captureToolDescriptor() map[string]any {
 			"context": map[string]any{
 				"type": "object",
 				"properties": map[string]any{
-					"harness": str("descriptive harness label (telemetry only, never a gate input)"),
+					"harness":     str("descriptive harness label (telemetry only, never a gate input)"),
 					"session_ref": str("optional session reference"), "fidelity": str("live-capture|transcript-parse|agent-runlog"),
 					"actor": str("acting user/agent"), "classification": str("caller-declared sensitivity: public|internal|confidential"),
 				},
 			},
 			"insights": map[string]any{"type": "array", "items": insightItem},
 			"tickets":  map[string]any{"type": "array", "items": ticketItem},
-			"dry_run": map[string]any{"type": "boolean", "description": "validate + return the would-be receipt, write nothing"},
+			"dry_run":  map[string]any{"type": "boolean", "description": "validate + return the would-be receipt, write nothing"},
 		},
 	}
 	b, _ := json.Marshal(schema)