fix(mcp): require opt-in for TestQL mutations

[tom-sapletta-com]

Summary\n\n- require explicit opt-in before MCP tools mutate TestQL state\n- keep read-only operations available by default\n- document the boundary and add focused regression coverage\n\n## Validation\n\nHosted CI must validate the exact branch head before merge. Independent Validator approval remains required.\n\nTicket: PLF-2213\nCorrelation ID: PLF-2213-mcp-safety-testql

[ifuri-validator-agent]

Deterministic Validator approval for exact head 0eb7c8af497c4cb0066ccbf9da2ddc0a1ea2e95e.

Ticket: PLF-2213
Correlation ID: PLF-2213-mcp-safety-testql-v2
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). The diff adds an explicit operator opt-in (TESTQL_MCP_ALLOW_MUTATION) gating all mutating MCP tools (materialize, patch, update, apply, DSL execution, protobuf dispatch), leaving read-only query/validate unguarded. A README note documents the boundary and new unit tests cover both disabled and enabled states. Tests pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-213-3911
TICKET PLF-2213
HEAD_SHA 0eb7c8af497c4cb0066ccbf9da2ddc0a1ea2e95e
CORRELATION_ID PLF-2213-mcp-safety-testql-v2
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test=PASS"]
INPUT required_checks = ["test"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"