feat(tools): native MCP client — mount stdio MCP servers as Correx tools

Adds an MCP host layer so external MCP servers (AST/LSP code-intelligence,
package resolvers, etc.) can be mounted at startup and surface their tools/list
as first-class Correx tools named mcp__<server>__<tool>. Each MCP tool is a
Tool+ToolExecutor, so it rides the normal ToolExecutor path and inherits tier
gating, receipts, and event-recorded execution (#5) with zero special-casing;
replay reads the recorded receipt rather than re-calling the server (#8/#9).

- McpProtocol/McpStdioClient/McpTool/McpMounter in infrastructure:tools
  (stdio JSON-RPC 2.0, tools/* slice only). Capabilities empty; safety via
  default T2 tier since external side effects are opaque.
- [[mcp]] config (id/command/env/tier) + array-of-tables parsing.
- Main wires mounted servers into extraTools (main + per-workspace paths) with
  a shutdown hook; a server that fails to start is logged and skipped.
- Tests: in-process fake transport (handshake/list/call/error + tool mapping),
  [[mcp]] parser.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/src/main/kotlin/com/correx/apps/server/Main.kt

@@ -210,14 +210,21 @@ fun main() {
     val explicitWorkspaceRoot = System.getenv("CORREX_WORKSPACE_ROOT")
         ?.let { Path.of(it) }
         ?: toolsConfig.workspaceRoot.takeIf { it.isNotEmpty() }?.let { Path.of(it) }
-    // workingDir and workspaceRoot must resolve to the same tree by default — the tool-call
-    // assessor's containment rules (PathContainmentRule, ManifestContainmentRule) only ever see
-    // workspaceRoot, while FileWriteTool resolves relative paths against workingDir. If only one
-    // is configured, each falls back to the other before falling back to process CWD, so the
-    // assessor's containment check and the actual write always share one resolved root.
     val shellAllowedExecutables = toolsConfig.shellAllowedExecutables.toSet()
-    val workspaceRoot = explicitWorkspaceRoot ?: explicitWorkingDir ?: Path.of("").toAbsolutePath()
-    val workingDir = explicitWorkingDir ?: workspaceRoot
+    val bootWorkspace = resolveBootWorkspace(
+        explicitWorkspaceRoot = explicitWorkspaceRoot,
+        explicitWorkingDir = explicitWorkingDir,
+        processWorkingDir = Path.of(""),
+    )
+    val workspaceRoot = bootWorkspace.workspaceRoot
+    val workingDir = bootWorkspace.workingDir
+    if (bootWorkspace.workingDirWasClamped) {
+        log.warn(
+            "configured working_dir {} is outside workspace_root {}; clamping working_dir to workspace_root",
+            explicitWorkingDir,
+            workspaceRoot,
+        )
+    }
     // One shared HTTP client backs both the default and per-workspace registries' research tools
     // (web_search/web_fetch). Built only when research is enabled, so the static path stays offline.
     // Lives for the process lifetime (shared across requests), so it's closed via shutdown hook
@@ -262,7 +269,34 @@ fun main() {
     )
     // Retrieves full tool output the kernel spilled to CAS on truncation (ref shown in-context).
     val toolOutputTool = com.correx.infrastructure.tools.ToolOutputTool(artifactStore)
-    val extraTools = taskTools + toolOutputTool
+    // Mount configured MCP servers: each server's tools/list becomes Correx tools that ride the normal
+    // ToolExecutor path (tier-gated, event-recorded, replay-safe — no special-casing). A server that
+    // fails to start is logged and skipped rather than aborting the whole process.
+    val mountedMcpServers = correxConfig.mcp.mapNotNull { mcpConfig ->
+        runCatching {
+            runBlocking {
+                com.correx.infrastructure.tools.mcp.McpMounter.mount(
+                    serverId = mcpConfig.id,
+                    command = mcpConfig.command,
+                    env = mcpConfig.env,
+                    tier = runCatching { com.correx.core.approvals.Tier.valueOf(mcpConfig.tier) }
+                        .getOrDefault(com.correx.core.approvals.Tier.T2),
+                )
+            }
+        }.onSuccess { log.info("Mounted MCP server '{}' ({} tools)", mcpConfig.id, it.tools.size) }
+            .onFailure { log.warn("Failed to mount MCP server '{}': {}", mcpConfig.id, it.message) }
+            .getOrNull()
+    }
+    if (mountedMcpServers.isNotEmpty()) {
+        Runtime.getRuntime().addShutdownHook(Thread {
+            mountedMcpServers.forEach { server ->
+                runCatching { server.close() }
+                    .onFailure { log.warn("Error closing MCP server '{}': {}", server.serverId, it.message) }
+            }
+        })
+    }
+    val mcpTools = mountedMcpServers.flatMap { it.tools }
+    val extraTools = taskTools + toolOutputTool + mcpTools
     val toolRegistry = InfrastructureModule.createToolRegistry(
         buildToolConfig(
             workspaceRoot,
@@ -545,7 +579,7 @@ fun main() {
     fun buildProjectMemory(cfg: CorrexConfig): com.correx.apps.server.memory.ProjectMemoryService? =
         if (cfg.project.enabled) {
             com.correx.apps.server.memory.ProjectMemoryService(
-                config = cfg.project,
+                config = cfg.project.boundToWorkspace(workspaceRoot),
                 embedder = embedder,
                 l3MemoryStore = l3MemoryStore,
                 journalRepository = decisionJournalRepository,
@@ -871,7 +905,7 @@ private fun buildToolConfig(
     toolsConfig: com.correx.core.config.ToolsConfig,
     research: com.correx.infrastructure.tools.ResearchToolConfig,
 ): ToolConfig {
-    val allowed = setOf(workspaceRoot, workingDir)
+    val allowed = setOf(workspaceRoot)
     return ToolConfig(
         shell = ShellConfig(
             enabled = toolsConfig.shellEnabled,