feat: expose governed attended actions over MCP

[abrichr]

Summary

• Expose the PHI-safe Needs Attention queue and exact Continue, Skip, Teach, and Escalate actions over local MCP stdio.
• Keep execution, policy, identity, verification, deterministic resume, repair, and audit inside openadapt-flow.
• Require signed capability binding, stable idempotency keys, action-specific confirmation, MCP form elicitation, and the effective local OS identity.
• Preserve all four capabilities through the Flow attended console/CLI when an MCP client lacks elicitation.
• Require openadapt-flow >=1.18.1,<2 and align registry, Smithery, Agent Skill, and Beta product copy.
• Run code-only, MIT/copyleft, and crown-jewel checks against built archives.

Why

Flow PR 152 and its owner-thread follow-up are merged and released, but the agent bridge still stopped at surfacing halts. This connects the existing public mechanism to MCP and Agent Skills without creating a second runtime or weakening the governed attended contract.

Safety and behavior

• Run tools and attended mutations remain separately opt-in.
• Default MCP projections use opaque IDs and count/boolean metadata; raw names, values, evidence, paths, subprocess output, and exceptions stay local.
• Continue verifies the operator-completed outcome and resumes after it without re-actuating the completed task.
• Skip is limited to a current, declared, non-consequential skip capability.
• Stale capabilities, invalid dispositions, uncertain delivery, absent live configuration, and declined or missing elicitation fail closed.
• The bridge remains local stdio; it does not add remote authentication or a second execution engine.

Verification

Rebased on agent origin/main 37ae5a8 and tested against exact Flow origin/main 0212128 (openadapt-flow 1.19.0), not the stale PR 152 checkout.

• Local pytest: 66 passed.
• Built agent and Flow-main wheels in a fresh environment: 66 passed.
• Ruff lint and changed-file format checks: passed.
• Sdist and wheel build: passed.
• Both release boundary gates: passed.
• GitHub Python 3.10, 3.11, and 3.12: passed.
• GitHub release dry run, CodeQL, dependency review, and gitleaks: passed.
• Wheel SHA-256: c433c144fa7dfbd34f305f9738b65ea3b2348efb3a7c5ec5042af16205c11a7a.
• Sdist SHA-256: f2a11591ce8d7392ef2c5a27815c313f168a79fc282ce86cde6905d19b5a0992.