feat: expose read-only MCP interface

[bilby91]

Summary

• add a curated read-only MCP Streamable HTTP adapter over the existing Medea query service
• expose seven inventory and rollout tools for Iris without credentials or mutations
• document the security boundary and future SEP-2663 Tasks mapping
• add adapter contract coverage and a real-process serve integration test

Validation

• go test -race ./internal/delivery/mcpapi ./cmd/medea
• go vet ./...
• go test ./...
• git diff --check