Improve MCP tool-call security

Currently, tool calls are handled automatically and recursively. This is insecure and potentially error-prone.

Instead, when a tool call request comes in from the assistant, we should:

• Show details about the tool call to the user
  • Ask what to do next:
    • Whitelist tool once (and run)
    • Whitelist tool for conversation (and run)
    • Whitelist tool for workspace (and run)
    • Whitelist tool globally (and run)
    • Reject tool call (reply with error)
    • Provide custom tool call response (in case you want to run the tool manually and copy/paste the results)
  • When the tool runs, we should show detailed information about the run and the results
  • When the tool is finished running, we should ask:
    • Send tool call result
    • Reject result (reply with error)
    • Provide custom tool call response

Additionally, we should guard against using the wrong MCP server by allowing to provide a sha1 string for comparison with the actual binary. This also guards against changing tool names, which would invalidate the config. Additionally, the config should fail if a tool name is used that doesn't exist.

All of this should be configurable:

[mcp.servers.*] # defaults
enable = true

[mcp.servers.*.tools.*] # defaults
enable = true
auto_run = false
auto_send = false

[mcp.servers.bookworm]
# JP errors if sha1 doesn't match with configured binary.
sha1 = "3bf2826cb656c427369349ca5a3ceafb6aa8c377"

# JP errors if there is no tool called `search_crates` for the `bookworm` server.
[mcp.servers.bookworm.tools.search_crates]
auto_run = true

[mcp.servers.github.tools.create_issue]
auto_run = false

There is (much) more we can do here, such as requiring MCP servers to run in containers, or other ways to contain them, but let's start with these basics first.

The issue names no files, tests, or entry points. Start by tracing the existing automatic and recursive MCP tool-call handling, then map the requested approval, execution-result, server-hash, and tool-name validation behavior to the current configuration system. Done means the security controls are configurable and invalid server hashes or tool names fail safely.