audit: webfetch failure cache crosses logical sessions in daemon mode

**Summary:** The webfetch failure cache (`failedUrls` in `tool/webfetch.ts:33`) is module-scoped and persists across logical sessions in `altimate serve` / MCP daemon mode. For up to 30 minutes after one user fetches a URL that 404s, that URL (normalized but path/query intact) is observable to every other session running in the same daemon process.

**Risk:** Multi-tenant heap exposure. Crash dumps, debug bundles (`altimate debug bundle`), or process snapshots could surface one tenant's failed-URL surface to support engineers. The userinfo strip + auth-param strip (added in v0.7.3) mitigate but don't eliminate.

**Recommended fix:**
1. Audit whether `altimate serve` is documented multi-tenant-safe. If yes, scope the cache by sessionID (`Map>`). If no, document the single-tenant assumption in the deploy docs.
2. Add a debug command `altimate debug webfetch-cache --clear` to operationally wipe it.

**Origin:** Deferred from v0.7.3 release review (CTO + Compliance, P2).