fix(mcp): reject edits that strip a note's frontmatter fence

Round-3 review found a fourth bypass: checkClaimEnvelope always validates
frontmatterScalars(after), but an edit whose new_str drops the closing
"---" degrades `after` to "unfenced" in the same call. frontmatterBlock(after)
then returns ok=false, frontmatterScalars returns an empty map, and
claim.ValidateEnvelope({}) is nil by design (absent fields are valid) — so
an invalid enum value lands on disk with zero error, and the note is left
permanently unfenced.

A note that had a valid fence before the edit must still have one after, or
the edit is rejected outright — closes this off structurally rather than
special-casing the fence-removal shape. Also guards oldStr == "" as a no-op
(strings.Replace treats "" as matching position 0, which would otherwise
look like an edit that inserts text before the fence): that degenerate case
belongs to notes.Edit's own "old_str is empty" refusal (#115), not to the
envelope check — TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes caught
the regression when this guard was still missing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ingestion/internal/mcp/tools_notes_test.go

@@ -168,6 +168,34 @@ func TestBrainEdit_RejectsAnOldStrThatCrossesTheClosingFence(t *testing.T) {
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 
+func TestBrainEdit_RejectsAnEditThatRemovesTheClosingFence(t *testing.T) {
+	// Found in round-3 review: checkClaimEnvelope always validates the
+	// resulting frontmatter of `after` — but an edit whose new_str drops
+	// the closing "---" degrades `after` to "unfenced" in the same call.
+	// frontmatterBlock(after) then returns ok=false, frontmatterScalars
+	// returns an empty map, and claim.ValidateEnvelope({}) is nil by
+	// design (absent fields are valid) — so an invalid enum value lands on
+	// disk with zero error, and the note is left permanently unfenced.
+	// Structural fix: a note that had a valid fence before the edit must
+	// still have one after, or the edit is rejected outright.
+	dir := newBrainRepo(t)
+	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
+	require.NoError(t, os.WriteFile(note,
+		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
+	srv := mcp.NewServer(dir, nil, nil, nil)
+
+	resp := call(t, srv, "brain_edit", map[string]any{
+		"path":    "wiki/homelab/facts/n.md",
+		"old_str": "claim_provenance: asserted\n---\n",
+		"new_str": "claim_provenance: not-a-real-value\n",
+	})
+	require.Contains(t, resp, "error", "%v", resp)
+
+	got, err := os.ReadFile(note)
+	require.NoError(t, err)
+	assert.Contains(t, string(got), "claim_provenance: asserted\n---\n", "rejected edit must leave the note byte-identical, fence intact")
+}
+
 func TestBrainEdit_AllowsAValidClaimEnvelopeEdit(t *testing.T) {
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")