feat(security): MCP supply-chain controls for extended-tier repos

**Context:** ROADMAP.md → Security → MCP supply-chain controls
**Related:** #429 (signed attestation RFC—complementary), extended-tool-capability-tiers draft, #246

---

## Component

Agent (Python runtime)

## Describe the feature

For **extended-tier** repos (see tool capability tiers draft):

- **Pin or self-host** MCP servers (no floating upstream URLs in production).
- Keep **`.mcp.json` in version control**; blueprint references pinned commit/artifact.
- **Verify tool descriptors** before enablement (hash/signature check at task start).
- **No dynamic tool discovery** in production blueprints (static allowlist only).

Mitigates tool poisoning and rug-pull risks where a remote MCP server changes tool behavior after onboarding.

## Use case

MCP expands agent capability but introduces supply-chain risk: a compromised or updated MCP server can exfiltrate data or add malicious tools. Extended-tier repos need controls comparable to dependency pinning.

## Proposed solution

1. Registry (#246) stores pinned MCP server artifacts with immutable versions.
2. Runtime validates descriptor hash at resolution; reject drift.
3. Blueprint `mcp_servers[]` entries require `registry_ref@version` in production mode.
4. Cedar deny for `mcp.discover` / dynamic registration in production.
5. Operator audit when pinned version ages beyond policy.
6. Document in `docs/design/SECURITY.md`, `docs/design/COMPUTE.md`.

## Other information

- Distinct from #429 (attestation for `AGENTS.md` / instruction files).
- Requires **extended tool capability tiers** draft.
- Design context: `docs/design/COMPUTE.md`, `docs/design/SECURITY.md`.

- [x] This might be a breaking change

Empieza por ROADMAP.md y el borrador extended-tool-capability-tiers; después, lee docs/design/SECURITY.md y docs/design/COMPUTE.md junto con issue #246 y el Agent Python runtime context. Se considera terminado cuando los controles de cadena de suministro de MCP del extended-tier, las restricciones de producción, la verificación de descriptores, la auditoría de antigüedad de versiones y la documentación relacionada tengan una implementación definida y revisable.

Escrito por el modelo de indexación a partir del texto del issue.