feat(security): MCP supply-chain controls for extended-tier repos

**Context:** ROADMAP.md → Security → MCP supply-chain controls
**Related:** #429 (signed attestation RFC—complementary), extended-tool-capability-tiers draft, #246

---

## Component

Agent (Python runtime)

## Describe the feature

For **extended-tier** repos (see tool capability tiers draft):

- **Pin or self-host** MCP servers (no floating upstream URLs in production).
- Keep **`.mcp.json` in version control**; blueprint references pinned commit/artifact.
- **Verify tool descriptors** before enablement (hash/signature check at task start).
- **No dynamic tool discovery** in production blueprints (static allowlist only).

Mitigates tool poisoning and rug-pull risks where a remote MCP server changes tool behavior after onboarding.

## Use case

MCP expands agent capability but introduces supply-chain risk: a compromised or updated MCP server can exfiltrate data or add malicious tools. Extended-tier repos need controls comparable to dependency pinning.

## Proposed solution

1. Registry (#246) stores pinned MCP server artifacts with immutable versions.
2. Runtime validates descriptor hash at resolution; reject drift.
3. Blueprint `mcp_servers[]` entries require `registry_ref@version` in production mode.
4. Cedar deny for `mcp.discover` / dynamic registration in production.
5. Operator audit when pinned version ages beyond policy.
6. Document in `docs/design/SECURITY.md`, `docs/design/COMPUTE.md`.

## Other information

- Distinct from #429 (attestation for `AGENTS.md` / instruction files).
- Requires **extended tool capability tiers** draft.
- Design context: `docs/design/COMPUTE.md`, `docs/design/SECURITY.md`.

- [x] This might be a breaking change

ROADMAP.md と extended-tool-capability-tiers のドラフトから始め、続いて docs/design/SECURITY.md と docs/design/COMPUTE.md を issue #246 および Agent Python runtime context と併せて読みます。extended-tier MCP サプライチェーン制御、本番環境の制限、ディスクリプタの検証、バージョン経過期間の監査、および関連ドキュメントについて、定義されレビュー可能な実装が完了条件です。

索引モデルが issue の本文から書いたものです。