feat(security): MCP supply-chain controls for extended-tier repos

**Context:** ROADMAP.md → Security → MCP supply-chain controls
**Related:** #429 (signed attestation RFC—complementary), extended-tool-capability-tiers draft, #246

---

## Component

Agent (Python runtime)

## Describe the feature

For **extended-tier** repos (see tool capability tiers draft):

- **Pin or self-host** MCP servers (no floating upstream URLs in production).
- Keep **`.mcp.json` in version control**; blueprint references pinned commit/artifact.
- **Verify tool descriptors** before enablement (hash/signature check at task start).
- **No dynamic tool discovery** in production blueprints (static allowlist only).

Mitigates tool poisoning and rug-pull risks where a remote MCP server changes tool behavior after onboarding.

## Use case

MCP expands agent capability but introduces supply-chain risk: a compromised or updated MCP server can exfiltrate data or add malicious tools. Extended-tier repos need controls comparable to dependency pinning.

## Proposed solution

1. Registry (#246) stores pinned MCP server artifacts with immutable versions.
2. Runtime validates descriptor hash at resolution; reject drift.
3. Blueprint `mcp_servers[]` entries require `registry_ref@version` in production mode.
4. Cedar deny for `mcp.discover` / dynamic registration in production.
5. Operator audit when pinned version ages beyond policy.
6. Document in `docs/design/SECURITY.md`, `docs/design/COMPUTE.md`.

## Other information

- Distinct from #429 (attestation for `AGENTS.md` / instruction files).
- Requires **extended tool capability tiers** draft.
- Design context: `docs/design/COMPUTE.md`, `docs/design/SECURITY.md`.

- [x] This might be a breaking change

Start with ROADMAP.md and the extended-tool-capability-tiers draft, then read docs/design/SECURITY.md and docs/design/COMPUTE.md alongside issue #246 and the Agent Python runtime context. Done means the extended-tier MCP supply-chain controls, production restrictions, descriptor verification, version-age auditing, and related documentation have a defined, reviewable implementation.

Written by the indexing model from the issue text.