feat(security): MCP supply-chain controls for extended-tier repos

**Context:** ROADMAP.md → Security → MCP supply-chain controls
**Related:** #429 (signed attestation RFC—complementary), extended-tool-capability-tiers draft, #246

---

## Component

Agent (Python runtime)

## Describe the feature

For **extended-tier** repos (see tool capability tiers draft):

- **Pin or self-host** MCP servers (no floating upstream URLs in production).
- Keep **`.mcp.json` in version control**; blueprint references pinned commit/artifact.
- **Verify tool descriptors** before enablement (hash/signature check at task start).
- **No dynamic tool discovery** in production blueprints (static allowlist only).

Mitigates tool poisoning and rug-pull risks where a remote MCP server changes tool behavior after onboarding.

## Use case

MCP expands agent capability but introduces supply-chain risk: a compromised or updated MCP server can exfiltrate data or add malicious tools. Extended-tier repos need controls comparable to dependency pinning.

## Proposed solution

1. Registry (#246) stores pinned MCP server artifacts with immutable versions.
2. Runtime validates descriptor hash at resolution; reject drift.
3. Blueprint `mcp_servers[]` entries require `registry_ref@version` in production mode.
4. Cedar deny for `mcp.discover` / dynamic registration in production.
5. Operator audit when pinned version ages beyond policy.
6. Document in `docs/design/SECURITY.md`, `docs/design/COMPUTE.md`.

## Other information

- Distinct from #429 (attestation for `AGENTS.md` / instruction files).
- Requires **extended tool capability tiers** draft.
- Design context: `docs/design/COMPUTE.md`, `docs/design/SECURITY.md`.

- [x] This might be a breaking change

Beginne mit ROADMAP.md und dem Entwurf extended-tool-capability-tiers und lies anschließend docs/design/SECURITY.md und docs/design/COMPUTE.md zusammen mit Issue #246 und dem Agent Python runtime context. Als abgeschlossen gilt die Aufgabe, wenn die extended-tier MCP-Lieferkettenkontrollen, die Produktionsbeschränkungen, die Deskriptorverifizierung, die Prüfung des Versionsalters und die zugehörige Dokumentation definiert und überprüfbar implementiert sind.

Vom Indexierungsmodell aus dem Issue-Text verfasst.