feat(workflows): grant codebase-memory MCP tools to code-intel stages

Explicit per-stage grants (least-privilege, invariant #5) for the mounted
codebase-memory MCP side-car:
- role_pipeline: discovery bootstraps the graph (index_repository) + grounds;
  analyst/architect/decomposer/implementer/reviewer get read-only query tools
  (search_code/search_graph/get_architecture/trace_path/get_code_snippet)
  scoped to each role. NOTE: architect flips from pure-reasoning to tool-calling.
- review_loop implement+review and task_planning planner get read-only queries.

Tools are approval-gated at T2 (server default in config.toml [[mcp]]).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/workflows/task_planning.toml

@@ -9,7 +9,11 @@ start = "planner"
 [[stages]]
 id = "planner"
 prompt = "prompts/task_planner.md"
-allowed_tools = ["file_read", "shell", "task_search", "task_context", "task_decompose", "task_create"]
+allowed_tools = [
+    "file_read", "shell", "task_search", "task_context", "task_decompose", "task_create",
+    "mcp__codebase-memory__search_code",
+    "mcp__codebase-memory__search_graph",
+]
 require_task_decompose = true
 token_budget = 16384
 max_retries = 2