feat(tools): inject the tools MCP into the session CLI config at spawn (#39)

[Reese-max]

Refs #39

Summary

OPENAB_TOOLS_MCP_URL put the loopback endpoint in the child's environment,
but wiring it into the CLI was manual: mcp add per session plus a
hand-edited allowlist, and both hard-coded a URL whose key dies on the next
spawn. At spawn the runtime now writes the session-independent form for
the CLI variants it knows — kiro-cli first:

• ~/.local/share/openab-pty/computer-mcp-bridge.js — a small stdio bridge
  embedded in the binary and rewritten each spawn; every stdin line is one
  JSON-RPC message POSTed to $OPENAB_TOOLS_MCP_URL (JSON and SSE replies,
  Mcp-Session-Id echoed, per-id JSON-RPC errors on HTTP failure).
• ~/.kiro/settings/mcp.json gains exactly the computer server
  {command: <bundled bun / PATH bun / node>=18, args: [bridge], env: {OPENAB_TOOLS_MCP_URL: "${OPENAB_TOOLS_MCP_URL}"}} — every other
  server and setting is preserved, and the file never holds a URL or key, so
  the shared workspace config needs no refresh when the key rotates.
• every ~/.kiro/agents/*.json gains @computer/* in allowedTools, plus
  @computer in a restrictive tools list and a computer entry in
  mcpServers for agents that opt out of the shared mcp.json. Agent files
  are merged, never created.
• Writes are atomic (sibling tempfile + rename, write through resolvable
  symlinks, preserve existing file modes). Malformed, non-object, or
  foreign-shaped files are left byte-identical; dangling symlinks are left
  alone rather than replaced.
• Unknown CLI variant → nothing is written and the §9.3 env-var manual path
  stands. tools_listen unset → injection never runs. A failed merge warns
  and never costs a spawn.

Detection: kiro-cli on the child's PATH or under the installer's
~/.local layout; JS runtime = bundled bun → ~/.local/share/kiro-cli/bun
→ PATH bun → PATH node (with a --version probe, node ≥ 18 required for
fetch).

Also includes a preparatory commit hoisting the crate into a repo-root
Cargo workspace (Cargo.toml/Cargo.lock at root), so cargo test/fmt/clippy --workspace work from a checkout root as well as from
runtime/; Dockerfiles, CI cache, and dependabot updated to match.

Test plan

• cargo fmt --all -- --check
• cargo test --workspace (175 unit + 13 config tests incl. injection
  merge/preservation, unknown-variant, tools-off, node<18, dangling
  symlink, mode-preservation, and restart-rotation byte-identical)
• cargo clippy --workspace --all-targets -- -D warnings
• bridge e2e (ignored): real node process + real HTTP stub — JSON-RPC
  round-trip, SSE multi-line normalization, notification silence
• session tests: fresh tools spawn injects zero-step config; restart
  rotates the env key while the file stays byte-identical; unwritable
  workspace still spawns

Docs: runtime/CLIENT-CONTRACT.md §9.3 rewritten for the auto-injection +
manual fallback; docs/k8s-howto.md §6 notes the zero-step CLI side.

Generated with Devin