feat(security): MCP supply-chain controls for extended-tier repos

**Context:** ROADMAP.md → Security → MCP supply-chain controls
**Related:** #429 (signed attestation RFC—complementary), extended-tool-capability-tiers draft, #246

---

## Component

Agent (Python runtime)

## Describe the feature

For **extended-tier** repos (see tool capability tiers draft):

- **Pin or self-host** MCP servers (no floating upstream URLs in production).
- Keep **`.mcp.json` in version control**; blueprint references pinned commit/artifact.
- **Verify tool descriptors** before enablement (hash/signature check at task start).
- **No dynamic tool discovery** in production blueprints (static allowlist only).

Mitigates tool poisoning and rug-pull risks where a remote MCP server changes tool behavior after onboarding.

## Use case

MCP expands agent capability but introduces supply-chain risk: a compromised or updated MCP server can exfiltrate data or add malicious tools. Extended-tier repos need controls comparable to dependency pinning.

## Proposed solution

1. Registry (#246) stores pinned MCP server artifacts with immutable versions.
2. Runtime validates descriptor hash at resolution; reject drift.
3. Blueprint `mcp_servers[]` entries require `registry_ref@version` in production mode.
4. Cedar deny for `mcp.discover` / dynamic registration in production.
5. Operator audit when pinned version ages beyond policy.
6. Document in `docs/design/SECURITY.md`, `docs/design/COMPUTE.md`.

## Other information

- Distinct from #429 (attestation for `AGENTS.md` / instruction files).
- Requires **extended tool capability tiers** draft.
- Design context: `docs/design/COMPUTE.md`, `docs/design/SECURITY.md`.

- [x] This might be a breaking change

Inizia da ROADMAP.md e dalla bozza extended-tool-capability-tiers, quindi leggi docs/design/SECURITY.md e docs/design/COMPUTE.md insieme a issue #246 e all’Agent Python runtime context. Il lavoro è completo quando i controlli della supply chain MCP dell’extended-tier, le restrizioni di produzione, la verifica dei descrittori, l’audit dell’età delle versioni e la documentazione correlata hanno un’implementazione definita e verificabile in revisione.

Scritto dal modello di indicizzazione a partire dal testo della issue.